Analysis
-
max time kernel
139s -
max time network
32s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
13-07-2020 06:37
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER INQUIRY.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
NEW ORDER INQUIRY.exe
Resource
win10
General
-
Target
NEW ORDER INQUIRY.exe
-
Size
337KB
-
MD5
d8e2e042791b6f4c7ae28624d7a1de92
-
SHA1
5373277d7bc120b129897505b566e7e2d31543d1
-
SHA256
50bb1f29f0f8ed951bfa9f9d6dc45611765f20f683cdc2270c5a2c8b7dff1d3f
-
SHA512
2a44d414a10391919a68113657aa50eca22a1d0497f9ff1d8a48e078f70cbefec811e31eadbb1f57b2d893c72ac9e34d4b1a41dbd5698e0a17d7a5c5a8002f74
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
atk9202
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1832-4-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1832-5-0x0000000000446F9E-mapping.dmp family_agenttesla behavioral1/memory/1832-6-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1832-7-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEW ORDER INQUIRY.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\YYtJku = "C:\\Users\\Admin\\AppData\\Roaming\\YYtJku\\YYtJku.exe" NEW ORDER INQUIRY.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NEW ORDER INQUIRY.exedescription pid process target process PID 1400 set thread context of 1832 1400 NEW ORDER INQUIRY.exe NEW ORDER INQUIRY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
NEW ORDER INQUIRY.exeNEW ORDER INQUIRY.exepid process 1400 NEW ORDER INQUIRY.exe 1400 NEW ORDER INQUIRY.exe 1832 NEW ORDER INQUIRY.exe 1832 NEW ORDER INQUIRY.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
NEW ORDER INQUIRY.exepid process 1832 NEW ORDER INQUIRY.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
NEW ORDER INQUIRY.exeNEW ORDER INQUIRY.exedescription pid process Token: SeDebugPrivilege 1400 NEW ORDER INQUIRY.exe Token: SeDebugPrivilege 1832 NEW ORDER INQUIRY.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
NEW ORDER INQUIRY.exedescription pid process target process PID 1400 wrote to memory of 1784 1400 NEW ORDER INQUIRY.exe schtasks.exe PID 1400 wrote to memory of 1784 1400 NEW ORDER INQUIRY.exe schtasks.exe PID 1400 wrote to memory of 1784 1400 NEW ORDER INQUIRY.exe schtasks.exe PID 1400 wrote to memory of 1784 1400 NEW ORDER INQUIRY.exe schtasks.exe PID 1400 wrote to memory of 1712 1400 NEW ORDER INQUIRY.exe NEW ORDER INQUIRY.exe PID 1400 wrote to memory of 1712 1400 NEW ORDER INQUIRY.exe NEW ORDER INQUIRY.exe PID 1400 wrote to memory of 1712 1400 NEW ORDER INQUIRY.exe NEW ORDER INQUIRY.exe PID 1400 wrote to memory of 1712 1400 NEW ORDER INQUIRY.exe NEW ORDER INQUIRY.exe PID 1400 wrote to memory of 1844 1400 NEW ORDER INQUIRY.exe NEW ORDER INQUIRY.exe PID 1400 wrote to memory of 1844 1400 NEW ORDER INQUIRY.exe NEW ORDER INQUIRY.exe PID 1400 wrote to memory of 1844 1400 NEW ORDER INQUIRY.exe NEW ORDER INQUIRY.exe PID 1400 wrote to memory of 1844 1400 NEW ORDER INQUIRY.exe NEW ORDER INQUIRY.exe PID 1400 wrote to memory of 1832 1400 NEW ORDER INQUIRY.exe NEW ORDER INQUIRY.exe PID 1400 wrote to memory of 1832 1400 NEW ORDER INQUIRY.exe NEW ORDER INQUIRY.exe PID 1400 wrote to memory of 1832 1400 NEW ORDER INQUIRY.exe NEW ORDER INQUIRY.exe PID 1400 wrote to memory of 1832 1400 NEW ORDER INQUIRY.exe NEW ORDER INQUIRY.exe PID 1400 wrote to memory of 1832 1400 NEW ORDER INQUIRY.exe NEW ORDER INQUIRY.exe PID 1400 wrote to memory of 1832 1400 NEW ORDER INQUIRY.exe NEW ORDER INQUIRY.exe PID 1400 wrote to memory of 1832 1400 NEW ORDER INQUIRY.exe NEW ORDER INQUIRY.exe PID 1400 wrote to memory of 1832 1400 NEW ORDER INQUIRY.exe NEW ORDER INQUIRY.exe PID 1400 wrote to memory of 1832 1400 NEW ORDER INQUIRY.exe NEW ORDER INQUIRY.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER INQUIRY.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER INQUIRY.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SBddfICSqVw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp46DE.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER INQUIRY.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER INQUIRY.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER INQUIRY.exe"{path}"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp46DE.tmpMD5
bc54942eb128cc9643132560a12fd586
SHA18c1972eab475429cee2f6b5030ecae9b91384d67
SHA25638bca1ab69f033efab95064ad4dea8099f0c72b8c5bfdccb1b5c9b516b6471cc
SHA51228ee2cc431cfee2434ee2ff6b77a0662767a1326b2362be2719f45705b87b6df758af75df2cee4afab8a643de2e322ddbf1cb1b6dc0cce9bb711a313c8d23ea7
-
memory/1400-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1784-2-0x0000000000000000-mapping.dmp
-
memory/1832-4-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1832-5-0x0000000000446F9E-mapping.dmp
-
memory/1832-6-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1832-7-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB