Analysis
-
max time kernel
133s -
max time network
120s -
platform
windows10_x64 -
resource
win10 -
submitted
07-07-2020 09:51
Static task
static1
Behavioral task
behavioral1
Sample
purchase order.exe
Resource
win7v200430
General
-
Target
purchase order.exe
-
Size
482KB
-
MD5
cc8dd999e2986f15641dfad4362cf2a7
-
SHA1
abeb848ddcfba06a03ba90f4c55e28c56e47494c
-
SHA256
b6eecf6385766748acdbd8b0b350d9344f775495a0ca62a1dcca578d2b6100ca
-
SHA512
e43349ee45e8bed299a1cdbd0485f454f3c2dcc4f795e788541dc47860dda859584d34baef4306f4140783f9f39b6e6cb6f42da47e99428168511a0d59c147c0
Malware Config
Extracted
Protocol: smtp- Host:
mail.pierreinsurancebrokers.com - Port:
587 - Username:
[email protected] - Password:
advisor@1234
Extracted
agenttesla
Protocol: smtp- Host:
mail.pierreinsurancebrokers.com - Port:
587 - Username:
[email protected] - Password:
advisor@1234
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2064-2-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral2/memory/2064-3-0x0000000000446C5E-mapping.dmp family_agenttesla -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
purchase order.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion purchase order.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion purchase order.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
purchase order.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum purchase order.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 purchase order.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
purchase order.exedescription pid process target process PID 3892 set thread context of 2064 3892 purchase order.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
purchase order.exeMSBuild.exepid process 3892 purchase order.exe 3892 purchase order.exe 3892 purchase order.exe 2064 MSBuild.exe 2064 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
purchase order.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 3892 purchase order.exe Token: SeDebugPrivilege 2064 MSBuild.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
purchase order.exedescription pid process target process PID 3892 wrote to memory of 1668 3892 purchase order.exe schtasks.exe PID 3892 wrote to memory of 1668 3892 purchase order.exe schtasks.exe PID 3892 wrote to memory of 1668 3892 purchase order.exe schtasks.exe PID 3892 wrote to memory of 2424 3892 purchase order.exe MSBuild.exe PID 3892 wrote to memory of 2424 3892 purchase order.exe MSBuild.exe PID 3892 wrote to memory of 2424 3892 purchase order.exe MSBuild.exe PID 3892 wrote to memory of 2064 3892 purchase order.exe MSBuild.exe PID 3892 wrote to memory of 2064 3892 purchase order.exe MSBuild.exe PID 3892 wrote to memory of 2064 3892 purchase order.exe MSBuild.exe PID 3892 wrote to memory of 2064 3892 purchase order.exe MSBuild.exe PID 3892 wrote to memory of 2064 3892 purchase order.exe MSBuild.exe PID 3892 wrote to memory of 2064 3892 purchase order.exe MSBuild.exe PID 3892 wrote to memory of 2064 3892 purchase order.exe MSBuild.exe PID 3892 wrote to memory of 2064 3892 purchase order.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\purchase order.exe"C:\Users\Admin\AppData\Local\Temp\purchase order.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PZDaFZwtnXm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3B3A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3B3A.tmpMD5
d602f45bec11d0993fc42b17663ec27c
SHA180f42b2467a351eb7d68225c55b4f97fca1026a1
SHA25635546b66d3fb8f369f4e70e585d9c399dfba8cfe7cb42f24fe001e41a0ad5da2
SHA512fffd1829debf2e1ea8b5b747b888166c7ae9382b4ff0214c23d76dd9bdab546aefc9f5a14455aa93c39573964971e5845a548ef418b22903486a0ed29fe9daa8
-
memory/1668-0-0x0000000000000000-mapping.dmp
-
memory/2064-2-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2064-3-0x0000000000446C5E-mapping.dmp