Analysis
-
max time kernel
150s -
max time network
15s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:59
Static task
static1
Behavioral task
behavioral1
Sample
QUOTE 002242020.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
QUOTE 002242020.exe
Resource
win10v20201028
General
-
Target
QUOTE 002242020.exe
-
Size
2.1MB
-
MD5
bdbfa33c09b950889d9fc19954f20935
-
SHA1
d9c6cf2322734d49a1c479ff31d044ccef2f739e
-
SHA256
51558f41331f2345cd146dc9705f48e8a6fdc425e6744658ff2ea53d42d34ae6
-
SHA512
5ab3679f6c523a4a5d73678461f5089713b06fde01d59d42e2ca728d7723af01d135eba0737bf1606f105bb0a64573807cc687b8f4ba0666f4678948f1ae6fa7
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.parshavayealborz.com - Port:
587 - Username:
info@parshavayealborz.com - Password:
P@rshava123456
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/532-17-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/532-18-0x000000000044C43E-mapping.dmp family_agenttesla behavioral1/memory/532-19-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla -
Processes:
resource yara_rule behavioral1/memory/288-4-0x0000000007E80000-0x0000000008034000-memory.dmp rezer0 behavioral1/memory/1528-13-0x0000000007DA0000-0x0000000007F1B000-memory.dmp rezer0 -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
MSBuild.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts MSBuild.exe -
Drops startup file 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ReAgentc.url RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
MSBuild.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\CpSnJ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CpSnJ\\CpSnJ.exe" MSBuild.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
QUOTE 002242020.exeRegSvcs.exeRegSvcs.exedescription pid process target process PID 288 set thread context of 1528 288 QUOTE 002242020.exe RegSvcs.exe PID 1528 set thread context of 520 1528 RegSvcs.exe RegSvcs.exe PID 520 set thread context of 532 520 RegSvcs.exe MSBuild.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
MSBuild.exeRegSvcs.exepid process 532 MSBuild.exe 532 MSBuild.exe 520 RegSvcs.exe 520 RegSvcs.exe 520 RegSvcs.exe 520 RegSvcs.exe 520 RegSvcs.exe 520 RegSvcs.exe 520 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 532 MSBuild.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
RegSvcs.exepid process 520 RegSvcs.exe 520 RegSvcs.exe 520 RegSvcs.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
RegSvcs.exepid process 520 RegSvcs.exe 520 RegSvcs.exe 520 RegSvcs.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
QUOTE 002242020.exeRegSvcs.exeRegSvcs.exeMSBuild.exedescription pid process target process PID 288 wrote to memory of 1528 288 QUOTE 002242020.exe RegSvcs.exe PID 288 wrote to memory of 1528 288 QUOTE 002242020.exe RegSvcs.exe PID 288 wrote to memory of 1528 288 QUOTE 002242020.exe RegSvcs.exe PID 288 wrote to memory of 1528 288 QUOTE 002242020.exe RegSvcs.exe PID 288 wrote to memory of 1528 288 QUOTE 002242020.exe RegSvcs.exe PID 288 wrote to memory of 1528 288 QUOTE 002242020.exe RegSvcs.exe PID 288 wrote to memory of 1528 288 QUOTE 002242020.exe RegSvcs.exe PID 288 wrote to memory of 1528 288 QUOTE 002242020.exe RegSvcs.exe PID 288 wrote to memory of 1528 288 QUOTE 002242020.exe RegSvcs.exe PID 288 wrote to memory of 1528 288 QUOTE 002242020.exe RegSvcs.exe PID 288 wrote to memory of 1528 288 QUOTE 002242020.exe RegSvcs.exe PID 288 wrote to memory of 1528 288 QUOTE 002242020.exe RegSvcs.exe PID 1528 wrote to memory of 520 1528 RegSvcs.exe RegSvcs.exe PID 1528 wrote to memory of 520 1528 RegSvcs.exe RegSvcs.exe PID 1528 wrote to memory of 520 1528 RegSvcs.exe RegSvcs.exe PID 1528 wrote to memory of 520 1528 RegSvcs.exe RegSvcs.exe PID 1528 wrote to memory of 520 1528 RegSvcs.exe RegSvcs.exe PID 1528 wrote to memory of 520 1528 RegSvcs.exe RegSvcs.exe PID 1528 wrote to memory of 520 1528 RegSvcs.exe RegSvcs.exe PID 1528 wrote to memory of 520 1528 RegSvcs.exe RegSvcs.exe PID 1528 wrote to memory of 520 1528 RegSvcs.exe RegSvcs.exe PID 1528 wrote to memory of 520 1528 RegSvcs.exe RegSvcs.exe PID 1528 wrote to memory of 520 1528 RegSvcs.exe RegSvcs.exe PID 1528 wrote to memory of 520 1528 RegSvcs.exe RegSvcs.exe PID 1528 wrote to memory of 520 1528 RegSvcs.exe RegSvcs.exe PID 1528 wrote to memory of 520 1528 RegSvcs.exe RegSvcs.exe PID 520 wrote to memory of 532 520 RegSvcs.exe MSBuild.exe PID 520 wrote to memory of 532 520 RegSvcs.exe MSBuild.exe PID 520 wrote to memory of 532 520 RegSvcs.exe MSBuild.exe PID 520 wrote to memory of 532 520 RegSvcs.exe MSBuild.exe PID 520 wrote to memory of 532 520 RegSvcs.exe MSBuild.exe PID 520 wrote to memory of 532 520 RegSvcs.exe MSBuild.exe PID 532 wrote to memory of 1532 532 MSBuild.exe REG.exe PID 532 wrote to memory of 1532 532 MSBuild.exe REG.exe PID 532 wrote to memory of 1532 532 MSBuild.exe REG.exe PID 532 wrote to memory of 1532 532 MSBuild.exe REG.exe PID 532 wrote to memory of 636 532 MSBuild.exe netsh.exe PID 532 wrote to memory of 636 532 MSBuild.exe netsh.exe PID 532 wrote to memory of 636 532 MSBuild.exe netsh.exe PID 532 wrote to memory of 636 532 MSBuild.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTE 002242020.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE 002242020.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"4⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f5⤵
- Modifies registry key
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/288-1-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/288-3-0x0000000000280000-0x000000000028F000-memory.dmpFilesize
60KB
-
memory/288-4-0x0000000007E80000-0x0000000008034000-memory.dmpFilesize
1.7MB
-
memory/288-0-0x00000000740B0000-0x000000007479E000-memory.dmpFilesize
6.9MB
-
memory/520-14-0x0000000000400000-0x0000000000579000-memory.dmpFilesize
1.5MB
-
memory/520-15-0x000000000042800A-mapping.dmp
-
memory/520-16-0x0000000000400000-0x0000000000579000-memory.dmpFilesize
1.5MB
-
memory/532-21-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/532-19-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/532-18-0x000000000044C43E-mapping.dmp
-
memory/532-17-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/532-20-0x0000000072E90000-0x000000007357E000-memory.dmpFilesize
6.9MB
-
memory/636-24-0x0000000000000000-mapping.dmp
-
memory/1528-6-0x00000000005AD5E6-mapping.dmp
-
memory/1528-13-0x0000000007DA0000-0x0000000007F1B000-memory.dmpFilesize
1.5MB
-
memory/1528-12-0x00000000003F0000-0x00000000003FB000-memory.dmpFilesize
44KB
-
memory/1528-9-0x0000000074030000-0x000000007471E000-memory.dmpFilesize
6.9MB
-
memory/1528-8-0x0000000000400000-0x00000000005B2000-memory.dmpFilesize
1.7MB
-
memory/1528-7-0x0000000000400000-0x00000000005B2000-memory.dmpFilesize
1.7MB
-
memory/1528-5-0x0000000000400000-0x00000000005B2000-memory.dmpFilesize
1.7MB
-
memory/1532-23-0x0000000000000000-mapping.dmp