Analysis
-
max time kernel
102s -
max time network
44s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
22-07-2021 07:02
Static task
static1
Behavioral task
behavioral1
Sample
Technical Drawing Specification.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Technical Drawing Specification.exe
Resource
win10v20210408
General
-
Target
Technical Drawing Specification.exe
-
Size
1.1MB
-
MD5
ad0aa820dcbc9a5e4287457c8eaf6cdb
-
SHA1
366b710a60122772ca55b7dbc7a01a64ff9c848f
-
SHA256
1f36a33a58c5ff8769f6476da0bce547f0dee33b6128cb95b27e6074fc920f5f
-
SHA512
a0574d7e042a64d3251ae114593aa05cb0aa023d1c402ad25ea7394e97ec5828a6b3c22ec983362bb1908352922743908da2ecc614ea1f932b9fb56dfe4c70f8
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mhoteljakarta.com - Port:
587 - Username:
info@mhoteljakarta.com - Password:
infom27
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1468-68-0x000000000043783E-mapping.dmp family_agenttesla behavioral1/memory/1468-67-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1468-70-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Technical Drawing Specification.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\NewApp = "C:\\Users\\Admin\\AppData\\Roaming\\NewApp\\NewApp.exe" Technical Drawing Specification.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Technical Drawing Specification.exedescription pid process target process PID 736 set thread context of 1468 736 Technical Drawing Specification.exe Technical Drawing Specification.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Technical Drawing Specification.exepowershell.exepid process 1468 Technical Drawing Specification.exe 1468 Technical Drawing Specification.exe 340 powershell.exe 340 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Technical Drawing Specification.exepowershell.exedescription pid process Token: SeDebugPrivilege 1468 Technical Drawing Specification.exe Token: SeDebugPrivilege 340 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Technical Drawing Specification.exedescription pid process target process PID 736 wrote to memory of 340 736 Technical Drawing Specification.exe powershell.exe PID 736 wrote to memory of 340 736 Technical Drawing Specification.exe powershell.exe PID 736 wrote to memory of 340 736 Technical Drawing Specification.exe powershell.exe PID 736 wrote to memory of 340 736 Technical Drawing Specification.exe powershell.exe PID 736 wrote to memory of 1468 736 Technical Drawing Specification.exe Technical Drawing Specification.exe PID 736 wrote to memory of 1468 736 Technical Drawing Specification.exe Technical Drawing Specification.exe PID 736 wrote to memory of 1468 736 Technical Drawing Specification.exe Technical Drawing Specification.exe PID 736 wrote to memory of 1468 736 Technical Drawing Specification.exe Technical Drawing Specification.exe PID 736 wrote to memory of 1468 736 Technical Drawing Specification.exe Technical Drawing Specification.exe PID 736 wrote to memory of 1468 736 Technical Drawing Specification.exe Technical Drawing Specification.exe PID 736 wrote to memory of 1468 736 Technical Drawing Specification.exe Technical Drawing Specification.exe PID 736 wrote to memory of 1468 736 Technical Drawing Specification.exe Technical Drawing Specification.exe PID 736 wrote to memory of 1468 736 Technical Drawing Specification.exe Technical Drawing Specification.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Technical Drawing Specification.exe"C:\Users\Admin\AppData\Local\Temp\Technical Drawing Specification.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Technical Drawing Specification.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Technical Drawing Specification.exe"C:\Users\Admin\AppData\Local\Temp\Technical Drawing Specification.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/340-86-0x0000000006060000-0x0000000006061000-memory.dmpFilesize
4KB
-
memory/340-87-0x00000000060E0000-0x00000000060E1000-memory.dmpFilesize
4KB
-
memory/340-74-0x00000000010D0000-0x00000000010D1000-memory.dmpFilesize
4KB
-
memory/340-111-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/340-76-0x00000000047B0000-0x00000000047B1000-memory.dmpFilesize
4KB
-
memory/340-66-0x0000000000000000-mapping.dmp
-
memory/340-110-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/340-77-0x00000000047B2000-0x00000000047B3000-memory.dmpFilesize
4KB
-
memory/340-109-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/340-69-0x00000000757E1000-0x00000000757E3000-memory.dmpFilesize
8KB
-
memory/340-72-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/340-73-0x00000000047F0000-0x00000000047F1000-memory.dmpFilesize
4KB
-
memory/340-95-0x00000000055D0000-0x00000000055D1000-memory.dmpFilesize
4KB
-
memory/340-94-0x0000000006200000-0x0000000006201000-memory.dmpFilesize
4KB
-
memory/340-81-0x0000000006020000-0x0000000006021000-memory.dmpFilesize
4KB
-
memory/340-78-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/736-60-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/736-62-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/736-65-0x0000000004650000-0x000000000468D000-memory.dmpFilesize
244KB
-
memory/736-63-0x0000000000380000-0x000000000039B000-memory.dmpFilesize
108KB
-
memory/736-64-0x0000000007ED0000-0x0000000007F4F000-memory.dmpFilesize
508KB
-
memory/1468-75-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/1468-67-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1468-70-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1468-68-0x000000000043783E-mapping.dmp