Overview

overview

10

Static

static

New Order #21076.exe

windows7_x64

10

New Order #21076.exe

windows10_x64

10

Analysis

  • max time kernel
    132s
  • max time network
    26s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    25-01-2021 16:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New Order #21076.exe

  • Size

    926KB

  • MD5

    7de57138380dd92fbee7229d46adee4a

  • SHA1

    bb63c25fc5730c0766f6f0de491725bc034a8a1f

  • SHA256

    5a052664d784432a0f9a707401e4095bef5d7703c32f9314dd5c9bdd5b273a1d

  • SHA512

    709d5e1ece9924d54560c332c2e4ae62778fd3dabafaee53b5b7e4e90f83a271e434b071f3fdccc6b0de3183a556835f049341df0b3e7a61769000809333f85c

Score
10/10
agentteslaevasionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.tthyssenkrupp.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    pgrOSoL7

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla Payload 3 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Order #21076.exe
    "C:\Users\Admin\AppData\Local\Temp\New Order #21076.exe"
    1⤵
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1924
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mVidlWHLZus" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9AAA.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:576
    • C:\Users\Admin\AppData\Local\Temp\New Order #21076.exe
      "{path}"
      2⤵
        PID:944
      • C:\Users\Admin\AppData\Local\Temp\New Order #21076.exe
        "{path}"
        2⤵
          PID:308
        • C:\Users\Admin\AppData\Local\Temp\New Order #21076.exe
          "{path}"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:964

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Virtualization/Sandbox Evasion

      2
      T1497

      Credential Access

      Credentials in Files

      3
      T1081

      Discovery

      Query Registry

      4
      T1012

      Virtualization/Sandbox Evasion

      2
      T1497

      System Information Discovery

      3
      T1082

      Peripheral Device Discovery

      1
      T1120

      Lateral Movement

      Collection

      Data from Local System

      3
      T1005

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmp9AAA.tmp
        MD5

        66ec29372ee090b3607e0922a2c51ace

        SHA1

        9630dbc4d05d9a53fcc1b84366a74d0a2a296057

        SHA256

        3afd69e7b728acd09a4cf7eec62285add6b2b1621bcba93f083d0aa9f82f384b

        SHA512

        d3374724e772188e7fef096ade93322c8ee6c2b4334cf53034440b665c47ff1dcedaa48c14bd2c6c2308c5a95cebf3d782a632f0cbf349d82bea996d3d60bdf1

        Download Submit
      • memory/576-8-0x0000000000000000-mapping.dmp
        Download
      • memory/964-12-0x00000000742C0000-0x00000000749AE000-memory.dmp
        Filesize

        6.9MB

        Download
      • memory/964-10-0x0000000000400000-0x000000000043C000-memory.dmp
        Filesize

        240KB

        Download
      • memory/964-11-0x00000000004375FE-mapping.dmp
        Download
      • memory/964-13-0x0000000000400000-0x000000000043C000-memory.dmp
        Filesize

        240KB

        Download
      • memory/964-15-0x0000000004C40000-0x0000000004C41000-memory.dmp
        Filesize

        4KB

        Download
      • memory/964-16-0x0000000004C41000-0x0000000004C42000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1924-6-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1924-7-0x00000000053E0000-0x000000000546C000-memory.dmp
        Filesize

        560KB

        Download
      • memory/1924-5-0x0000000000390000-0x000000000039E000-memory.dmp
        Filesize

        56KB

        Download
      • memory/1924-3-0x0000000000BC0000-0x0000000000BC1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/1924-2-0x00000000742C0000-0x00000000749AE000-memory.dmp
        Filesize

        6.9MB

        Download