Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
117s -
platform
windows7_x64 -
resource
win7 -
submitted
07/07/2020, 13:22
Static task
static1
Behavioral task
behavioral1
Sample
Order.exe
Resource
win7
Behavioral task
behavioral2
Sample
Order.exe
Resource
win10v200430
General
-
Target
Order.exe
-
Size
686KB
-
MD5
73264b4a5cf35f2029d3ecd5f9ad5526
-
SHA1
50e13f20b9c5d3ba16dca9d44ff3cbe15b5065aa
-
SHA256
78cda73e2008c1ca39e0497d5065baf7404e4c6f943b7dab60b5eb6872c70098
-
SHA512
90ab76cc0ffdd6691d0be0c42dc27cc929345f806dfa281896072b6b75e59b4b34f85a1bac5e514264201a5267d869d83e4d8771010828ffa675d50bb7f4de01
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.napred.net - Port:
587 - Username:
[email protected] - Password:
Katarina85219!
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
resource yara_rule behavioral1/files/0x00040000000131bd-5.dat family_agenttesla behavioral1/files/0x00040000000131bd-7.dat family_agenttesla behavioral1/files/0x00040000000131bd-8.dat family_agenttesla behavioral1/memory/1864-15-0x000000000044A4FE-mapping.dmp family_agenttesla behavioral1/memory/1864-17-0x0000000000150000-0x00000000001A0000-memory.dmp family_agenttesla behavioral1/memory/1864-18-0x0000000000150000-0x00000000001A0000-memory.dmp family_agenttesla -
Executes dropped EXE 2 IoCs
pid Process 1700 application.exe 1864 AddInProcess32.exe -
Loads dropped DLL 2 IoCs
pid Process 1448 Order.exe 1700 application.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\application = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\application.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1700 set thread context of 1864 1700 application.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1448 Order.exe 1448 Order.exe 1448 Order.exe 1700 application.exe 1700 application.exe 1700 application.exe 1864 AddInProcess32.exe 1864 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1448 Order.exe Token: SeDebugPrivilege 1700 application.exe Token: SeDebugPrivilege 1864 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1448 wrote to memory of 800 1448 Order.exe 24 PID 1448 wrote to memory of 800 1448 Order.exe 24 PID 1448 wrote to memory of 800 1448 Order.exe 24 PID 1448 wrote to memory of 800 1448 Order.exe 24 PID 800 wrote to memory of 1064 800 cmd.exe 26 PID 800 wrote to memory of 1064 800 cmd.exe 26 PID 800 wrote to memory of 1064 800 cmd.exe 26 PID 800 wrote to memory of 1064 800 cmd.exe 26 PID 1448 wrote to memory of 1700 1448 Order.exe 27 PID 1448 wrote to memory of 1700 1448 Order.exe 27 PID 1448 wrote to memory of 1700 1448 Order.exe 27 PID 1448 wrote to memory of 1700 1448 Order.exe 27 PID 1700 wrote to memory of 1864 1700 application.exe 28 PID 1700 wrote to memory of 1864 1700 application.exe 28 PID 1700 wrote to memory of 1864 1700 application.exe 28 PID 1700 wrote to memory of 1864 1700 application.exe 28 PID 1700 wrote to memory of 1864 1700 application.exe 28 PID 1700 wrote to memory of 1864 1700 application.exe 28 PID 1700 wrote to memory of 1864 1700 application.exe 28 PID 1700 wrote to memory of 1864 1700 application.exe 28 PID 1700 wrote to memory of 1864 1700 application.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order.exe"C:\Users\Admin\AppData\Local\Temp\Order.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v application /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\application.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v application /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\application.exe"3⤵
- Adds Run key to start application
PID:1064
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\application.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\application.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-