Analysis
-
max time kernel
109s -
max time network
15s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
22-07-2021 12:04
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION 22072021.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
QUOTATION 22072021.exe
Resource
win10v20210410
General
-
Target
QUOTATION 22072021.exe
-
Size
742KB
-
MD5
506887f557d9399e9cd663b65b2271d5
-
SHA1
4ff9f4cc2408073bf91b87a92ba6f6d74efcead0
-
SHA256
1ba742a8035002362e46828bcb7a24342bed430d6bcd59999afd520dba3de81e
-
SHA512
bb87d67afb0b9263f2802a5ca3d8b36c6e5a0005d7f5fec632e189db4f4337408d9b8994ed9ac2482efe379ef07ee0cf0ffbbadf4f17aba3ff951a09f8d67204
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.totalkitchensandbathrooms.com.au - Port:
587 - Username:
[email protected] - Password:
Zs^I;kEMItH)
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/584-69-0x000000000043787E-mapping.dmp family_agenttesla behavioral1/memory/584-68-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/584-70-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
QUOTATION 22072021.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\NewApp = "C:\\Users\\Admin\\AppData\\Roaming\\NewApp\\NewApp.exe" QUOTATION 22072021.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
QUOTATION 22072021.exedescription pid process target process PID 2020 set thread context of 584 2020 QUOTATION 22072021.exe QUOTATION 22072021.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
QUOTATION 22072021.exepid process 584 QUOTATION 22072021.exe 584 QUOTATION 22072021.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
QUOTATION 22072021.exedescription pid process Token: SeDebugPrivilege 584 QUOTATION 22072021.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
QUOTATION 22072021.exedescription pid process target process PID 2020 wrote to memory of 1912 2020 QUOTATION 22072021.exe schtasks.exe PID 2020 wrote to memory of 1912 2020 QUOTATION 22072021.exe schtasks.exe PID 2020 wrote to memory of 1912 2020 QUOTATION 22072021.exe schtasks.exe PID 2020 wrote to memory of 1912 2020 QUOTATION 22072021.exe schtasks.exe PID 2020 wrote to memory of 584 2020 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2020 wrote to memory of 584 2020 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2020 wrote to memory of 584 2020 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2020 wrote to memory of 584 2020 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2020 wrote to memory of 584 2020 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2020 wrote to memory of 584 2020 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2020 wrote to memory of 584 2020 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2020 wrote to memory of 584 2020 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 2020 wrote to memory of 584 2020 QUOTATION 22072021.exe QUOTATION 22072021.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION 22072021.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION 22072021.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vkQnefEsxy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3208.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION 22072021.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION 22072021.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3208.tmpMD5
03591970430ce68612fcdaf09ad9702a
SHA14d85c39d72d4fc33b78f3226249fc82cb0cb7aec
SHA256c027fd2a2484ece08f09c56af8c3679cde6194fcaff9ba767cd6abb6a3374c70
SHA5123236746ed47f0cccf8594e0a744d7809ac2b911c40c52ac1453773827ab1449a7ad200bef33e4d9f4ed158345606112a0c2fdfb3db256e051010a01822ce8466
-
memory/584-69-0x000000000043787E-mapping.dmp
-
memory/584-68-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/584-70-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/584-72-0x0000000004790000-0x0000000004791000-memory.dmpFilesize
4KB
-
memory/1912-66-0x0000000000000000-mapping.dmp
-
memory/2020-60-0x0000000001180000-0x0000000001181000-memory.dmpFilesize
4KB
-
memory/2020-62-0x0000000004D20000-0x0000000004D21000-memory.dmpFilesize
4KB
-
memory/2020-63-0x00000000003A0000-0x00000000003BB000-memory.dmpFilesize
108KB
-
memory/2020-64-0x0000000007F30000-0x0000000007FB1000-memory.dmpFilesize
516KB
-
memory/2020-65-0x0000000000B30000-0x0000000000B6D000-memory.dmpFilesize
244KB