Analysis
-
max time kernel
141s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
22-07-2021 12:04
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION 22072021.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
QUOTATION 22072021.exe
Resource
win10v20210410
General
-
Target
QUOTATION 22072021.exe
-
Size
742KB
-
MD5
506887f557d9399e9cd663b65b2271d5
-
SHA1
4ff9f4cc2408073bf91b87a92ba6f6d74efcead0
-
SHA256
1ba742a8035002362e46828bcb7a24342bed430d6bcd59999afd520dba3de81e
-
SHA512
bb87d67afb0b9263f2802a5ca3d8b36c6e5a0005d7f5fec632e189db4f4337408d9b8994ed9ac2482efe379ef07ee0cf0ffbbadf4f17aba3ff951a09f8d67204
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.totalkitchensandbathrooms.com.au - Port:
587 - Username:
[email protected] - Password:
Zs^I;kEMItH)
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1608-127-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/1608-128-0x000000000043787E-mapping.dmp family_agenttesla behavioral2/memory/1608-134-0x0000000004D50000-0x000000000524E000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
QUOTATION 22072021.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\NewApp = "C:\\Users\\Admin\\AppData\\Roaming\\NewApp\\NewApp.exe" QUOTATION 22072021.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
QUOTATION 22072021.exedescription pid process target process PID 3156 set thread context of 1608 3156 QUOTATION 22072021.exe QUOTATION 22072021.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
QUOTATION 22072021.exepid process 1608 QUOTATION 22072021.exe 1608 QUOTATION 22072021.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
QUOTATION 22072021.exedescription pid process Token: SeDebugPrivilege 1608 QUOTATION 22072021.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
QUOTATION 22072021.exepid process 1608 QUOTATION 22072021.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
QUOTATION 22072021.exedescription pid process target process PID 3156 wrote to memory of 3204 3156 QUOTATION 22072021.exe schtasks.exe PID 3156 wrote to memory of 3204 3156 QUOTATION 22072021.exe schtasks.exe PID 3156 wrote to memory of 3204 3156 QUOTATION 22072021.exe schtasks.exe PID 3156 wrote to memory of 1608 3156 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 3156 wrote to memory of 1608 3156 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 3156 wrote to memory of 1608 3156 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 3156 wrote to memory of 1608 3156 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 3156 wrote to memory of 1608 3156 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 3156 wrote to memory of 1608 3156 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 3156 wrote to memory of 1608 3156 QUOTATION 22072021.exe QUOTATION 22072021.exe PID 3156 wrote to memory of 1608 3156 QUOTATION 22072021.exe QUOTATION 22072021.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION 22072021.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION 22072021.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vkQnefEsxy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE9C9.tmp"2⤵
- Creates scheduled task(s)
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\QUOTATION 22072021.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION 22072021.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1608
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QUOTATION 22072021.exe.logMD5
90acfd72f14a512712b1a7380c0faf60
SHA140ba4accb8faa75887e84fb8e38d598dc8cf0f12
SHA25620806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86
SHA51229dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9
-
C:\Users\Admin\AppData\Local\Temp\tmpE9C9.tmpMD5
ac0f752916663c0b6b2522e0da7febb3
SHA1bd6c1f517f104b35c79faa2bf4f057481c722c01
SHA256593d8fb848dc1b1e45f2cabf2746e011c3eb3b7790a8e1ff4b4855c648a34cc8
SHA512815a534cbee2f63fe83f9d4e2517ff5e805fc5f2f70dc071df5c671af3997e7bae0e1c2e184528cd630e8020332f404e8cb96e4330d223cec0d29114f3a0431d
-
memory/1608-136-0x0000000005AB0000-0x0000000005AB1000-memory.dmpFilesize
4KB
-
memory/1608-135-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/1608-134-0x0000000004D50000-0x000000000524E000-memory.dmpFilesize
5.0MB
-
memory/1608-128-0x000000000043787E-mapping.dmp
-
memory/1608-127-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3156-119-0x0000000004C50000-0x0000000004C51000-memory.dmpFilesize
4KB
-
memory/3156-123-0x0000000008310000-0x0000000008391000-memory.dmpFilesize
516KB
-
memory/3156-124-0x00000000083A0000-0x00000000083DD000-memory.dmpFilesize
244KB
-
memory/3156-122-0x0000000004F30000-0x0000000004F4B000-memory.dmpFilesize
108KB
-
memory/3156-121-0x0000000004B10000-0x0000000004BAC000-memory.dmpFilesize
624KB
-
memory/3156-120-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/3156-114-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/3156-118-0x0000000004CF0000-0x0000000004CF1000-memory.dmpFilesize
4KB
-
memory/3156-117-0x0000000005150000-0x0000000005151000-memory.dmpFilesize
4KB
-
memory/3156-116-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/3204-125-0x0000000000000000-mapping.dmp