Analysis
-
max time kernel
121s -
max time network
164s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22-07-2021 12:40
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION 22072021.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
QUOTATION 22072021.exe
Resource
win10v20210410
General
-
Target
QUOTATION 22072021.exe
-
Size
742KB
-
MD5
506887f557d9399e9cd663b65b2271d5
-
SHA1
4ff9f4cc2408073bf91b87a92ba6f6d74efcead0
-
SHA256
1ba742a8035002362e46828bcb7a24342bed430d6bcd59999afd520dba3de81e
-
SHA512
bb87d67afb0b9263f2802a5ca3d8b36c6e5a0005d7f5fec632e189db4f4337408d9b8994ed9ac2482efe379ef07ee0cf0ffbbadf4f17aba3ff951a09f8d67204
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.totalkitchensandbathrooms.com.au - Port:
587 - Username:
[email protected] - Password:
Zs^I;kEMItH)
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1844-68-0x000000000043787E-mapping.dmp family_agenttesla behavioral1/memory/1844-67-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1844-69-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
QUOTATION 22072021.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\NewApp = "C:\\Users\\Admin\\AppData\\Roaming\\NewApp\\NewApp.exe" QUOTATION 22072021.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
QUOTATION 22072021.exedescription pid process target process PID 2004 set thread context of 1844 2004 QUOTATION 22072021.exe QUOTATION 22072021.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
QUOTATION 22072021.exeQUOTATION 22072021.exepid process 2004 QUOTATION 22072021.exe 1844 QUOTATION 22072021.exe 1844 QUOTATION 22072021.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
QUOTATION 22072021.exeQUOTATION 22072021.exedescription pid process Token: SeDebugPrivilege 2004 QUOTATION 22072021.exe Token: SeDebugPrivilege 1844 QUOTATION 22072021.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
QUOTATION 22072021.exedescription pid process target process PID 2004 wrote to memory of 1752 2004 QUOTATION 22072021.exe schtasks.exe PID 2004 wrote to memory of 1752 2004 QUOTATION 22072021.exe schtasks.exe PID 2004 wrote to memory of 1752 2004 QUOTATION 22072021.exe schtasks.exe PID 2004 wrote to memory of 1752 2004 QUOTATION 22072021.exe schtasks.exe PID 2004 wrote to memory of 1812 2004 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2004 wrote to memory of 1812 2004 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2004 wrote to memory of 1812 2004 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2004 wrote to memory of 1812 2004 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2004 wrote to memory of 1844 2004 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2004 wrote to memory of 1844 2004 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2004 wrote to memory of 1844 2004 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2004 wrote to memory of 1844 2004 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2004 wrote to memory of 1844 2004 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2004 wrote to memory of 1844 2004 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2004 wrote to memory of 1844 2004 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2004 wrote to memory of 1844 2004 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2004 wrote to memory of 1844 2004 QUOTATION 22072021.exe QUOTATION 22072021.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION 22072021.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION 22072021.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vkQnefEsxy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp35FE.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION 22072021.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION 22072021.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION 22072021.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION 22072021.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp35FE.tmpMD5
c055c840b1c01c1b1d8aa36ae7b0e3bf
SHA15037e48b7d32c22bcd5bed634e48cd645a665ef4
SHA25669955caafb36dfccad623744f9b5f7f752ae5fef91c053ff83fc8c426577db39
SHA5127b50680ea48e07497fa91c022576c7f2ad1c8be64db497be8c46e6386b32e73e43270e511669ea93907b36b96dccfa28221788f6af7db46dac4051f49d3278a7
-
memory/1752-65-0x0000000000000000-mapping.dmp
-
memory/1844-68-0x000000000043787E-mapping.dmp
-
memory/1844-67-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1844-69-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1844-71-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/2004-59-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/2004-61-0x0000000004A50000-0x0000000004A51000-memory.dmpFilesize
4KB
-
memory/2004-62-0x00000000003F0000-0x000000000040B000-memory.dmpFilesize
108KB
-
memory/2004-63-0x0000000005D70000-0x0000000005DF1000-memory.dmpFilesize
516KB
-
memory/2004-64-0x0000000000820000-0x000000000085D000-memory.dmpFilesize
244KB