Analysis
-
max time kernel
96s -
max time network
74s -
platform
windows7_x64 -
resource
win7 -
submitted
13-07-2020 07:30
Static task
static1
Behavioral task
behavioral1
Sample
STATEMENTS AND OUTSTANDING AMOUNTS.exe
Resource
win7
Behavioral task
behavioral2
Sample
STATEMENTS AND OUTSTANDING AMOUNTS.exe
Resource
win10v200430
General
-
Target
STATEMENTS AND OUTSTANDING AMOUNTS.exe
-
Size
573KB
-
MD5
457de5690dbc92ae0e5e936846695dd6
-
SHA1
982c5af6b7784831bd9a28798142417358f2fec8
-
SHA256
f56840640186247deee56a36d22de91915a650be338be46de501c9a6ec67d4ea
-
SHA512
d0cb7e61aa3b01a45d29122a08318d453ea4f576942dbb1978e55b443a921e8af32f2cfc775d7afe65c130c550ef85005f92adb4e593df9231e00ca82653f5cd
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.varda.com.tr - Port:
587 - Username:
[email protected] - Password:
varda9997929
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/744-4-0x0000000000400000-0x0000000000474000-memory.dmp family_agenttesla behavioral1/memory/744-5-0x0000000000446E1E-mapping.dmp family_agenttesla behavioral1/memory/744-6-0x0000000000400000-0x0000000000474000-memory.dmp family_agenttesla behavioral1/memory/744-7-0x0000000000400000-0x0000000000474000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\CpSnJ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CpSnJ\\CpSnJ.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
STATEMENTS AND OUTSTANDING AMOUNTS.exedescription pid process target process PID 616 set thread context of 744 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
STATEMENTS AND OUTSTANDING AMOUNTS.exeRegSvcs.exepid process 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe 744 RegSvcs.exe 744 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
STATEMENTS AND OUTSTANDING AMOUNTS.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe Token: SeDebugPrivilege 744 RegSvcs.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
STATEMENTS AND OUTSTANDING AMOUNTS.exeRegSvcs.exedescription pid process target process PID 616 wrote to memory of 112 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe schtasks.exe PID 616 wrote to memory of 112 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe schtasks.exe PID 616 wrote to memory of 112 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe schtasks.exe PID 616 wrote to memory of 112 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe schtasks.exe PID 616 wrote to memory of 744 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe RegSvcs.exe PID 616 wrote to memory of 744 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe RegSvcs.exe PID 616 wrote to memory of 744 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe RegSvcs.exe PID 616 wrote to memory of 744 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe RegSvcs.exe PID 616 wrote to memory of 744 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe RegSvcs.exe PID 616 wrote to memory of 744 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe RegSvcs.exe PID 616 wrote to memory of 744 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe RegSvcs.exe PID 616 wrote to memory of 744 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe RegSvcs.exe PID 616 wrote to memory of 744 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe RegSvcs.exe PID 616 wrote to memory of 744 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe RegSvcs.exe PID 616 wrote to memory of 744 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe RegSvcs.exe PID 616 wrote to memory of 744 616 STATEMENTS AND OUTSTANDING AMOUNTS.exe RegSvcs.exe PID 744 wrote to memory of 1936 744 RegSvcs.exe REG.exe PID 744 wrote to memory of 1936 744 RegSvcs.exe REG.exe PID 744 wrote to memory of 1936 744 RegSvcs.exe REG.exe PID 744 wrote to memory of 1936 744 RegSvcs.exe REG.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\STATEMENTS AND OUTSTANDING AMOUNTS.exe"C:\Users\Admin\AppData\Local\Temp\STATEMENTS AND OUTSTANDING AMOUNTS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iTYdcX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAEB5.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f3⤵
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpAEB5.tmpMD5
825692ae7a96d3e65a8d01f0ae91bb03
SHA12a534301f4ff6312dedd85770b42625d2f8c286c
SHA256ac7f35cd80db45105c256529d2db223e18919d4a983582572ce3555977df6d49
SHA512806b578415139e6ac1054b61e8d8240445f45d6c8b4c985b42f6aa00dafa2560634fd257e8afbd73fcb266f56970634977a9b9ca3e2675a2f8633462c9a08dbd
-
memory/112-2-0x0000000000000000-mapping.dmp
-
memory/616-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/744-4-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/744-5-0x0000000000446E1E-mapping.dmp
-
memory/744-6-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/744-7-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1936-8-0x0000000000000000-mapping.dmp