Analysis
-
max time kernel
130s -
max time network
155s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
22-07-2021 11:58
Static task
static1
Behavioral task
behavioral1
Sample
Released Order.exe
Resource
win7v20210410
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Released Order.exe
Resource
win10v20210408
0 signatures
0 seconds
General
-
Target
Released Order.exe
-
Size
894KB
-
MD5
99d846bbf242277134ba3b6cb92ab2eb
-
SHA1
96dcb922a1213c55bce5edeada748112b760d9db
-
SHA256
1988aecd504c91c63584f0ee4aa3d1a9d6f0f879763e7fc695230ec2703cb07b
-
SHA512
2adddeb4c73b6591c1659a5d0e22b7cf57468ff85e58f1332609b7b9fd62a9da1be4218e76168804a99a1386959cc23222b3a2a7a1575a2e4210a8c534d5df13
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.saitools.com - Port:
587 - Username:
[email protected] - Password:
ecotanksystems$0912
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/816-67-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/816-68-0x000000000043761E-mapping.dmp family_agenttesla behavioral1/memory/816-69-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\kprUEGC = "C:\\Users\\Admin\\AppData\\Roaming\\kprUEGC\\kprUEGC.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Released Order.exedescription pid process target process PID 864 set thread context of 816 864 Released Order.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Released Order.exeRegSvcs.exepid process 864 Released Order.exe 816 RegSvcs.exe 816 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Released Order.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 864 Released Order.exe Token: SeDebugPrivilege 816 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 816 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Released Order.exedescription pid process target process PID 864 wrote to memory of 816 864 Released Order.exe RegSvcs.exe PID 864 wrote to memory of 816 864 Released Order.exe RegSvcs.exe PID 864 wrote to memory of 816 864 Released Order.exe RegSvcs.exe PID 864 wrote to memory of 816 864 Released Order.exe RegSvcs.exe PID 864 wrote to memory of 816 864 Released Order.exe RegSvcs.exe PID 864 wrote to memory of 816 864 Released Order.exe RegSvcs.exe PID 864 wrote to memory of 816 864 Released Order.exe RegSvcs.exe PID 864 wrote to memory of 816 864 Released Order.exe RegSvcs.exe PID 864 wrote to memory of 816 864 Released Order.exe RegSvcs.exe PID 864 wrote to memory of 816 864 Released Order.exe RegSvcs.exe PID 864 wrote to memory of 816 864 Released Order.exe RegSvcs.exe PID 864 wrote to memory of 816 864 Released Order.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Released Order.exe"C:\Users\Admin\AppData\Local\Temp\Released Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/816-67-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/816-68-0x000000000043761E-mapping.dmp
-
memory/816-69-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/816-71-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/816-72-0x0000000004CC1000-0x0000000004CC2000-memory.dmpFilesize
4KB
-
memory/864-60-0x0000000001110000-0x0000000001111000-memory.dmpFilesize
4KB
-
memory/864-62-0x00000000005A0000-0x00000000005F9000-memory.dmpFilesize
356KB
-
memory/864-63-0x0000000004B60000-0x0000000004B61000-memory.dmpFilesize
4KB
-
memory/864-64-0x0000000000520000-0x0000000000522000-memory.dmpFilesize
8KB
-
memory/864-65-0x0000000006670000-0x00000000066EA000-memory.dmpFilesize
488KB
-
memory/864-66-0x00000000010D0000-0x0000000001108000-memory.dmpFilesize
224KB