Analysis
-
max time kernel
104s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:59
General
-
Target
znol5gxxtd2gytr.msi
-
Size
492KB
-
MD5
3108d539e45f8a66f4ab8b2c5e20497f
-
SHA1
a514c5f3d637dd86af5d32ccf55bd7df2a3abec1
-
SHA256
abbcbdace318afff0408188e4e1025ebc49c3157838066d775b5e70a5c8c2620
-
SHA512
3da9c92951e893d2e8c3ac05b042580ffb693159d9b5536525e9bbdac39c6a14b577d23b5ff0ab5fd4b70a3f3dd7c0a98a383a191067a03910597b5c55dd9908
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.eljsn.website - Port:
587 - Username:
infotect@eljsn.website - Password:
5C%+1~13zgdJ**
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
-
rezer0 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
-
Executes dropped EXE 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 58 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\znol5gxxtd2gytr.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Installer\MSI6A89.tmp"C:\Windows\Installer\MSI6A89.tmp"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RfjXgrDPBFsZY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF39D.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Installer\MSI6A89.tmp"{path}"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSI6A89.tmp.logMD5
8088a978a15ef9d85ddf98584f54de96
SHA1d7ba55faff1ca42d7b702c94b5ed46ef0f9b9dbe
SHA2565879b074b6c57e4f0316edd0edec7f64324dcd2df84bde00fd90409bde579304
SHA512be87735be40efffa1053f1d99eb1923790368e3e7a2ddb7d740385b319ec6bfa410964486ab35a7e99ab6f312d204af9924c50c4e587aa127690e21940a72252
-
C:\Users\Admin\AppData\Local\Temp\tmpF39D.tmpMD5
3fbd532ffc7e0758549126137f7ce410
SHA13845a732f0e60ae0925853268e9189f118785784
SHA256538e8e3460fbdf57ebb254f8bc1d2dfc81f0064fe0cc017048c2038d3e3dd37d
SHA51234a9a6ade54b9ff2d75a2827062ec16f12070655a1e472cb607444c68a63fdd7d5ce1ea0260639774ea512a1adb52b1dd74d4367f1d53fbd43a1c2cc225eea59
-
C:\Windows\Installer\MSI6A89.tmpMD5
31310b7aaf4c734c755f9af5fdb21735
SHA1d684dff80d9c49019decb0c9c1c613aa525b0f37
SHA256a7e3766ef281daddb6fbdd9af745b0776abb319b7485ecec75160c3368827254
SHA5124f1998a78f4f23b242dbfb61376941930dbfb6304296740eefb898127df486a4cc09a6ad95ab5f87a157a018d35691d8733a9e9a6f17973edf3801aa613ad45d
-
C:\Windows\Installer\MSI6A89.tmpMD5
31310b7aaf4c734c755f9af5fdb21735
SHA1d684dff80d9c49019decb0c9c1c613aa525b0f37
SHA256a7e3766ef281daddb6fbdd9af745b0776abb319b7485ecec75160c3368827254
SHA5124f1998a78f4f23b242dbfb61376941930dbfb6304296740eefb898127df486a4cc09a6ad95ab5f87a157a018d35691d8733a9e9a6f17973edf3801aa613ad45d
-
C:\Windows\Installer\MSI6A89.tmpMD5
31310b7aaf4c734c755f9af5fdb21735
SHA1d684dff80d9c49019decb0c9c1c613aa525b0f37
SHA256a7e3766ef281daddb6fbdd9af745b0776abb319b7485ecec75160c3368827254
SHA5124f1998a78f4f23b242dbfb61376941930dbfb6304296740eefb898127df486a4cc09a6ad95ab5f87a157a018d35691d8733a9e9a6f17973edf3801aa613ad45d
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2MD5
8dad4ba27c6b577114eb53245816d8dd
SHA1998010b2b3526e49434cf2a88db84397cd4b3a43
SHA25657ea0966e1465bf394d47e8def2912f333ae640117d6d38166a4b91ffdbeb2ef
SHA51248a3f5f702d50d53ce30f999a4ef77a7cf92cdabc4e45e4385a449d3690fd1d91486f75e1e72505ff5eabeeef0b4ba0d91d58662c115acad055c193fe5cb3eb1
-
\??\Volume{f994966a-0000-0000-0000-500600000000}\System Volume Information\SPP\OnlineMetadataCache\{d6315ecd-6de5-4816-9f78-1b27aecf2ded}_OnDiskSnapshotPropMD5
e5fe749dfde93fbf6498e2c741af11c6
SHA1e5d6a4bd50cf9f76bcf99a47c765539125e30b4e
SHA256fa9f9a9130dcabc772873379e507143aa2b24fcf7b8a180ee75c6b952aff587e
SHA5121a16be47851836cd5c809340d4cdc41e4efcdfe8f80d9348a6249f3b92903863304a01c72246ea3808bc57719eeb1918dde044abb5769b1215bef416405e7f24
-
memory/520-7-0x0000000000EC0000-0x0000000000EC1000-memory.dmpFilesize
4KB
-
memory/520-3-0x0000000000000000-mapping.dmp
-
memory/520-11-0x00000000032C0000-0x00000000032D0000-memory.dmpFilesize
64KB
-
memory/520-9-0x00000000058C0000-0x00000000058C1000-memory.dmpFilesize
4KB
-
memory/520-14-0x0000000006060000-0x00000000060AD000-memory.dmpFilesize
308KB
-
memory/520-15-0x00000000065B0000-0x00000000065B1000-memory.dmpFilesize
4KB
-
memory/520-6-0x0000000073900000-0x0000000073FEE000-memory.dmpFilesize
6.9MB
-
memory/520-10-0x00000000059A0000-0x00000000059A1000-memory.dmpFilesize
4KB
-
memory/528-0-0x0000000000000000-mapping.dmp
-
memory/1900-16-0x0000000000000000-mapping.dmp
-
memory/2288-18-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2288-19-0x00000000004470BE-mapping.dmp
-
memory/2288-22-0x0000000073900000-0x0000000073FEE000-memory.dmpFilesize
6.9MB
-
memory/2288-28-0x0000000005500000-0x0000000005501000-memory.dmpFilesize
4KB
-
memory/2288-29-0x0000000005DD0000-0x0000000005DD1000-memory.dmpFilesize
4KB
-
memory/2288-31-0x00000000061E0000-0x00000000061E1000-memory.dmpFilesize
4KB
-
memory/4892-1-0x000001BF377A0000-0x000001BF37A21000-memory.dmpFilesize
2.5MB
-
memory/4892-25-0x000001BF36920000-0x000001BF36921000-memory.dmpFilesize
4KB