Analysis
-
max time kernel
109s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-11-2020 07:06
Static task
static1
Behavioral task
behavioral1
Sample
Pending Order Confirmation.gz.exe
Resource
win7v20201028
General
-
Target
Pending Order Confirmation.gz.exe
-
Size
669KB
-
MD5
fabea57872e14b1facc1f3ff573ae6b9
-
SHA1
d790a7ba0dbe886ca05580eb7f3bd47e7b5879ab
-
SHA256
ae6c488302c04f00a60835db6b955fb8e1eb42f0e73e71873f5b7dc630596755
-
SHA512
7ff1e78602417a2f7b1ccc9e2025851827aef1735605377e48a13a9fc629dffed7cea4262335741a86b82609c7d1b5fdc8a45fd9d611bbdf4fcca0bed98b59b7
Malware Config
Extracted
Protocol: smtp- Host:
smtp.shirdilog.com - Port:
587 - Username:
cs.maa@shirdilog.com - Password:
SL094521
Extracted
agenttesla
Protocol: smtp- Host:
smtp.shirdilog.com - Port:
587 - Username:
cs.maa@shirdilog.com - Password:
SL094521
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1788-13-0x0000000000400000-0x0000000000466000-memory.dmp family_agenttesla behavioral2/memory/1788-14-0x00000000004612BE-mapping.dmp family_agenttesla -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Pending Order Confirmation.gz.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Pending Order Confirmation.gz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Pending Order Confirmation.gz.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Pending Order Confirmation.gz.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Pending Order Confirmation.gz.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 Pending Order Confirmation.gz.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Pending Order Confirmation.gz.exedescription pid process target process PID 4076 set thread context of 1788 4076 Pending Order Confirmation.gz.exe Pending Order Confirmation.gz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Pending Order Confirmation.gz.exePending Order Confirmation.gz.exepid process 4076 Pending Order Confirmation.gz.exe 4076 Pending Order Confirmation.gz.exe 4076 Pending Order Confirmation.gz.exe 1788 Pending Order Confirmation.gz.exe 1788 Pending Order Confirmation.gz.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Pending Order Confirmation.gz.exePending Order Confirmation.gz.exedescription pid process Token: SeDebugPrivilege 4076 Pending Order Confirmation.gz.exe Token: SeDebugPrivilege 1788 Pending Order Confirmation.gz.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Pending Order Confirmation.gz.exepid process 1788 Pending Order Confirmation.gz.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Pending Order Confirmation.gz.exePending Order Confirmation.gz.exedescription pid process target process PID 4076 wrote to memory of 2344 4076 Pending Order Confirmation.gz.exe schtasks.exe PID 4076 wrote to memory of 2344 4076 Pending Order Confirmation.gz.exe schtasks.exe PID 4076 wrote to memory of 2344 4076 Pending Order Confirmation.gz.exe schtasks.exe PID 4076 wrote to memory of 1608 4076 Pending Order Confirmation.gz.exe Pending Order Confirmation.gz.exe PID 4076 wrote to memory of 1608 4076 Pending Order Confirmation.gz.exe Pending Order Confirmation.gz.exe PID 4076 wrote to memory of 1608 4076 Pending Order Confirmation.gz.exe Pending Order Confirmation.gz.exe PID 4076 wrote to memory of 1788 4076 Pending Order Confirmation.gz.exe Pending Order Confirmation.gz.exe PID 4076 wrote to memory of 1788 4076 Pending Order Confirmation.gz.exe Pending Order Confirmation.gz.exe PID 4076 wrote to memory of 1788 4076 Pending Order Confirmation.gz.exe Pending Order Confirmation.gz.exe PID 4076 wrote to memory of 1788 4076 Pending Order Confirmation.gz.exe Pending Order Confirmation.gz.exe PID 4076 wrote to memory of 1788 4076 Pending Order Confirmation.gz.exe Pending Order Confirmation.gz.exe PID 4076 wrote to memory of 1788 4076 Pending Order Confirmation.gz.exe Pending Order Confirmation.gz.exe PID 4076 wrote to memory of 1788 4076 Pending Order Confirmation.gz.exe Pending Order Confirmation.gz.exe PID 4076 wrote to memory of 1788 4076 Pending Order Confirmation.gz.exe Pending Order Confirmation.gz.exe PID 1788 wrote to memory of 2712 1788 Pending Order Confirmation.gz.exe REG.exe PID 1788 wrote to memory of 2712 1788 Pending Order Confirmation.gz.exe REG.exe PID 1788 wrote to memory of 2712 1788 Pending Order Confirmation.gz.exe REG.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pending Order Confirmation.gz.exe"C:\Users\Admin\AppData\Local\Temp\Pending Order Confirmation.gz.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ulahYEgUOnqdBN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp127F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Pending Order Confirmation.gz.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Pending Order Confirmation.gz.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer / v NoRun / t REG_DWORD / d 1 / f3⤵
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp127F.tmpMD5
ba0c86194e2675a6f1154713a26005b8
SHA195d7ac2eeffbb4c338bd0a6e352d4b1554f84c11
SHA256cddebd641539c1686d77d10790db227c4bb3f97438cf5cad1216b8595fc78fcf
SHA51272d3120ba1907735c931550f7994d8c0b542098296df82d46844a0a8cedc8f2847e02f2c89242746cd1ca4b84ce43fb0c04542a9003c5fe88f58cbe359a4165d
-
memory/1788-20-0x0000000005130000-0x0000000005131000-memory.dmpFilesize
4KB
-
memory/1788-15-0x00000000739A0000-0x000000007408E000-memory.dmpFilesize
6.9MB
-
memory/1788-14-0x00000000004612BE-mapping.dmp
-
memory/1788-13-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2344-11-0x0000000000000000-mapping.dmp
-
memory/2712-22-0x0000000000000000-mapping.dmp
-
memory/4076-5-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/4076-9-0x0000000008F10000-0x0000000008F9B000-memory.dmpFilesize
556KB
-
memory/4076-10-0x00000000095D0000-0x00000000095D1000-memory.dmpFilesize
4KB
-
memory/4076-8-0x00000000071C0000-0x00000000071D4000-memory.dmpFilesize
80KB
-
memory/4076-7-0x00000000070D0000-0x00000000070D1000-memory.dmpFilesize
4KB
-
memory/4076-6-0x00000000090A0000-0x00000000090A1000-memory.dmpFilesize
4KB
-
memory/4076-0-0x00000000739A0000-0x000000007408E000-memory.dmpFilesize
6.9MB
-
memory/4076-4-0x00000000056D0000-0x00000000056D1000-memory.dmpFilesize
4KB
-
memory/4076-3-0x0000000005BD0000-0x0000000005BD1000-memory.dmpFilesize
4KB
-
memory/4076-1-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB