Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
25-01-2021 14:33
General
-
Target
Top Urgent_New_Order_PDF.exe
-
Size
911KB
-
MD5
f71317984e36770287b066803de0ab00
-
SHA1
15f8bcac4aa7273f362ad1f474bf818ee5179b44
-
SHA256
ec51e50ebea3906ef87c852c95b256e3948a9bb789981a9dd1fe673d78663e66
-
SHA512
df2dd89cfdbeb05595e1c676adf3736ae8ebedcd3d1cc6ad6b4ea2f20a0d5fb149cab78d6f29c300eebf9e07c883596e1bc5267a561fed19d429c3f10e6989b9
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
webmail.rcsqatar.com - Port:
587 - Username:
[email protected] - Password:
Ascent@2019
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Top Urgent_New_Order_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Top Urgent_New_Order_PDF.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mPwwUYOq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBCDD.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Top Urgent_New_Order_PDF.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Top Urgent_New_Order_PDF.exe.logMD5
12557ab909651a6f99d3503d614d3562
SHA1b86745768059a514bea3a438e1e96086af463246
SHA2569589c869703e95d40d5870c60f66d8460f7914e9fe8dd579533c84148112babd
SHA51210cdb2fa7cf054af937b4aeddfe16fe755d6b09db5a51f7052adbf472b4b435e16c141f3712762f3b67f990c3efcfa47659576988e321214c747d6cd98e75521
-
C:\Users\Admin\AppData\Local\Temp\tmpBCDD.tmpMD5
1e690f1ebce46e5bcebe68bad1a9518c
SHA155f67d6cf779a526f369b26066b7bcb0838f6890
SHA256be9a069047f409aef858eed35e1838ac5d647138d395f7fc558fb4cc92fc884b
SHA512f36bb62e0a38dd1370959250540312bd04c74ac63b83caf5477eb6a58231e43fe2329b32891c1b9347263c09e9c793b19ecc6d8fb4c7682a5236da2e7324cb24
-
memory/1908-11-0x0000000005E60000-0x0000000005EE7000-memory.dmpFilesize
540KB
-
memory/1908-12-0x0000000006060000-0x0000000006061000-memory.dmpFilesize
4KB
-
memory/1908-7-0x0000000005160000-0x0000000005161000-memory.dmpFilesize
4KB
-
memory/1908-8-0x0000000005200000-0x000000000520E000-memory.dmpFilesize
56KB
-
memory/1908-9-0x0000000005320000-0x0000000005321000-memory.dmpFilesize
4KB
-
memory/1908-10-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/1908-2-0x0000000073920000-0x000000007400E000-memory.dmpFilesize
6.9MB
-
memory/1908-6-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/1908-3-0x00000000006E0000-0x00000000006E1000-memory.dmpFilesize
4KB
-
memory/1908-5-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/3100-13-0x0000000000000000-mapping.dmp
-
memory/3484-15-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3484-16-0x000000000043763E-mapping.dmp
-
memory/3484-18-0x0000000073920000-0x000000007400E000-memory.dmpFilesize
6.9MB
-
memory/3484-23-0x0000000005470000-0x0000000005471000-memory.dmpFilesize
4KB
-
memory/3484-24-0x0000000005500000-0x0000000005501000-memory.dmpFilesize
4KB