Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    09-11-2020 20:21

General

  • Target

    TT COPY.exe

  • Size

    540KB

  • MD5

    8cb73260e8cc3d0f51da164e2f30f9db

  • SHA1

    956cdf7991eff9c64e6d2b9148bec190f347f908

  • SHA256

    89080cc94eae4cab0a8d50729214296a16767368c12a4f679baab998fad152fc

  • SHA512

    fb173cf6d551e2e223010cf2180bdaa289ee1f531c64345663caed9496ee59f9edaf6fb18028516f37b805e0b57522b63ab858578705431a891dfbc8ea92a2e9

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.microtechlab.in
  • Port:
    587
  • Username:
    reports@microtechlab.in
  • Password:
    pune@123

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • CoreEntity .NET Packer 1 IoCs

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

  • AgentTesla Payload 14 IoCs
  • rezer0 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

  • Disables Task Manager via registry modification
  • Drops file in Drivers directory 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TT COPY.exe
    "C:\Users\Admin\AppData\Local\Temp\TT COPY.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4796
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "{path}"
      2⤵
      • Drops file in Drivers directory
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4352
      • C:\Windows\SysWOW64\REG.exe
        REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        3⤵
        • Modifies registry key
        PID:1172
      • C:\Windows\SysWOW64\netsh.exe
        "netsh" wlan show profile
        3⤵
          PID:1608
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 1548
          3⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2324

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    2
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1172-22-0x0000000000000000-mapping.dmp
    • memory/1608-23-0x0000000000000000-mapping.dmp
    • memory/2324-37-0x00000000057D0000-0x00000000057D1000-memory.dmp
      Filesize

      4KB

    • memory/2324-24-0x0000000004FA0000-0x0000000004FA1000-memory.dmp
      Filesize

      4KB

    • memory/4352-29-0x000000000044CF5E-mapping.dmp
    • memory/4352-25-0x000000000044CF5E-mapping.dmp
    • memory/4352-34-0x000000000044CF5E-mapping.dmp
    • memory/4352-35-0x000000000044CF5E-mapping.dmp
    • memory/4352-30-0x000000000044CF5E-mapping.dmp
    • memory/4352-13-0x0000000000400000-0x0000000000452000-memory.dmp
      Filesize

      328KB

    • memory/4352-14-0x000000000044CF5E-mapping.dmp
    • memory/4352-15-0x00000000739D0000-0x00000000740BE000-memory.dmp
      Filesize

      6.9MB

    • memory/4352-20-0x0000000005200000-0x0000000005201000-memory.dmp
      Filesize

      4KB

    • memory/4352-21-0x0000000005CC0000-0x0000000005CC1000-memory.dmp
      Filesize

      4KB

    • memory/4352-31-0x000000000044CF5E-mapping.dmp
    • memory/4352-32-0x000000000044CF5E-mapping.dmp
    • memory/4352-36-0x000000000044CF5E-mapping.dmp
    • memory/4352-33-0x000000000044CF5E-mapping.dmp
    • memory/4352-27-0x000000000044CF5E-mapping.dmp
    • memory/4352-26-0x000000000044CF5E-mapping.dmp
    • memory/4352-28-0x000000000044CF5E-mapping.dmp
    • memory/4796-0-0x00000000739D0000-0x00000000740BE000-memory.dmp
      Filesize

      6.9MB

    • memory/4796-9-0x0000000004410000-0x0000000004411000-memory.dmp
      Filesize

      4KB

    • memory/4796-3-0x0000000004AE0000-0x0000000004B3E000-memory.dmp
      Filesize

      376KB

    • memory/4796-4-0x0000000008ED0000-0x0000000008ED1000-memory.dmp
      Filesize

      4KB

    • memory/4796-7-0x0000000009470000-0x0000000009471000-memory.dmp
      Filesize

      4KB

    • memory/4796-12-0x0000000005030000-0x0000000005031000-memory.dmp
      Filesize

      4KB

    • memory/4796-11-0x0000000004F30000-0x0000000004F83000-memory.dmp
      Filesize

      332KB

    • memory/4796-10-0x0000000004400000-0x0000000004402000-memory.dmp
      Filesize

      8KB

    • memory/4796-1-0x0000000000020000-0x0000000000021000-memory.dmp
      Filesize

      4KB