Analysis
-
max time kernel
99s -
max time network
36s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
13-07-2020 15:13
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order No AAPL-PO-1179-1990.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
Purchase Order No AAPL-PO-1179-1990.exe
Resource
win10
General
-
Target
Purchase Order No AAPL-PO-1179-1990.exe
-
Size
538KB
-
MD5
3a1635fd14ff9c17c0f65b8c393b9739
-
SHA1
1f6e011d27ab1bbcfb5d57494610327bcf889aeb
-
SHA256
e016bfbd170c4b15789abf7fa2ba30bec2bd785e2ec9b9fc759722833ed88a87
-
SHA512
c37644c6b1ae9bd046d3a98733cd357051d632d926d408fbfc9a327668442b328be0aa5f56de5ebb416d772a1109c45f86aff90ab20c70bea3fd2641913f2211
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.aquariuslogistics.com - Port:
587 - Username:
[email protected] - Password:
AQL@2019#$
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1884-4-0x0000000000400000-0x0000000000474000-memory.dmp family_agenttesla behavioral1/memory/1884-5-0x00000000004472EE-mapping.dmp family_agenttesla behavioral1/memory/1884-6-0x0000000000400000-0x0000000000474000-memory.dmp family_agenttesla behavioral1/memory/1884-7-0x0000000000400000-0x0000000000474000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\sLbGMVN = "C:\\Users\\Admin\\AppData\\Roaming\\sLbGMVN\\sLbGMVN.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Purchase Order No AAPL-PO-1179-1990.exedescription pid process target process PID 1500 set thread context of 1884 1500 Purchase Order No AAPL-PO-1179-1990.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Purchase Order No AAPL-PO-1179-1990.exeRegSvcs.exepid process 1500 Purchase Order No AAPL-PO-1179-1990.exe 1884 RegSvcs.exe 1884 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Purchase Order No AAPL-PO-1179-1990.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1500 Purchase Order No AAPL-PO-1179-1990.exe Token: SeDebugPrivilege 1884 RegSvcs.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Purchase Order No AAPL-PO-1179-1990.exeRegSvcs.exedescription pid process target process PID 1500 wrote to memory of 1860 1500 Purchase Order No AAPL-PO-1179-1990.exe schtasks.exe PID 1500 wrote to memory of 1860 1500 Purchase Order No AAPL-PO-1179-1990.exe schtasks.exe PID 1500 wrote to memory of 1860 1500 Purchase Order No AAPL-PO-1179-1990.exe schtasks.exe PID 1500 wrote to memory of 1860 1500 Purchase Order No AAPL-PO-1179-1990.exe schtasks.exe PID 1500 wrote to memory of 1884 1500 Purchase Order No AAPL-PO-1179-1990.exe RegSvcs.exe PID 1500 wrote to memory of 1884 1500 Purchase Order No AAPL-PO-1179-1990.exe RegSvcs.exe PID 1500 wrote to memory of 1884 1500 Purchase Order No AAPL-PO-1179-1990.exe RegSvcs.exe PID 1500 wrote to memory of 1884 1500 Purchase Order No AAPL-PO-1179-1990.exe RegSvcs.exe PID 1500 wrote to memory of 1884 1500 Purchase Order No AAPL-PO-1179-1990.exe RegSvcs.exe PID 1500 wrote to memory of 1884 1500 Purchase Order No AAPL-PO-1179-1990.exe RegSvcs.exe PID 1500 wrote to memory of 1884 1500 Purchase Order No AAPL-PO-1179-1990.exe RegSvcs.exe PID 1500 wrote to memory of 1884 1500 Purchase Order No AAPL-PO-1179-1990.exe RegSvcs.exe PID 1500 wrote to memory of 1884 1500 Purchase Order No AAPL-PO-1179-1990.exe RegSvcs.exe PID 1500 wrote to memory of 1884 1500 Purchase Order No AAPL-PO-1179-1990.exe RegSvcs.exe PID 1500 wrote to memory of 1884 1500 Purchase Order No AAPL-PO-1179-1990.exe RegSvcs.exe PID 1500 wrote to memory of 1884 1500 Purchase Order No AAPL-PO-1179-1990.exe RegSvcs.exe PID 1884 wrote to memory of 1508 1884 RegSvcs.exe REG.exe PID 1884 wrote to memory of 1508 1884 RegSvcs.exe REG.exe PID 1884 wrote to memory of 1508 1884 RegSvcs.exe REG.exe PID 1884 wrote to memory of 1508 1884 RegSvcs.exe REG.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order No AAPL-PO-1179-1990.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order No AAPL-PO-1179-1990.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LvUfBoWgxd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1C94.tmp"2⤵
- Creates scheduled task(s)
PID:1860 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f3⤵
- Modifies registry key
PID:1508
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
3073f740e8fe3f2b65537cf7980e474c
SHA14b1d555eb7234e3c5660275633843c10dafd280d
SHA2569ad7d2d0faed823504525199712ccb9acea97d48e3d339186e56b4ce489b3834
SHA5128471ad230ea88c428696c5b919df7a42293f60bbf14194d0579151997c1354291d0e6f41c89340d855e9fae114af63283cb17763eb5e5fcbd0d3335055d4cdaa