Analysis
-
max time kernel
135s -
max time network
68s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
22-07-2021 11:58
Static task
static1
Behavioral task
behavioral1
Sample
Released Order.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Released Order.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
Released Order.exe
-
Size
894KB
-
MD5
99d846bbf242277134ba3b6cb92ab2eb
-
SHA1
96dcb922a1213c55bce5edeada748112b760d9db
-
SHA256
1988aecd504c91c63584f0ee4aa3d1a9d6f0f879763e7fc695230ec2703cb07b
-
SHA512
2adddeb4c73b6591c1659a5d0e22b7cf57468ff85e58f1332609b7b9fd62a9da1be4218e76168804a99a1386959cc23222b3a2a7a1575a2e4210a8c534d5df13
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.saitools.com - Port:
587 - Username:
[email protected] - Password:
ecotanksystems$0912
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1628-125-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/1628-126-0x000000000043761E-mapping.dmp family_agenttesla behavioral2/memory/1628-131-0x0000000004EC0000-0x00000000053BE000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\kprUEGC = "C:\\Users\\Admin\\AppData\\Roaming\\kprUEGC\\kprUEGC.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Released Order.exedescription pid process target process PID 652 set thread context of 1628 652 Released Order.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Released Order.exeRegSvcs.exepid process 652 Released Order.exe 1628 RegSvcs.exe 1628 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Released Order.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 652 Released Order.exe Token: SeDebugPrivilege 1628 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1628 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Released Order.exedescription pid process target process PID 652 wrote to memory of 1628 652 Released Order.exe RegSvcs.exe PID 652 wrote to memory of 1628 652 Released Order.exe RegSvcs.exe PID 652 wrote to memory of 1628 652 Released Order.exe RegSvcs.exe PID 652 wrote to memory of 1628 652 Released Order.exe RegSvcs.exe PID 652 wrote to memory of 1628 652 Released Order.exe RegSvcs.exe PID 652 wrote to memory of 1628 652 Released Order.exe RegSvcs.exe PID 652 wrote to memory of 1628 652 Released Order.exe RegSvcs.exe PID 652 wrote to memory of 1628 652 Released Order.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Released Order.exe"C:\Users\Admin\AppData\Local\Temp\Released Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1628
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/652-114-0x0000000000D70000-0x0000000000D71000-memory.dmpFilesize
4KB
-
memory/652-116-0x0000000005730000-0x0000000005789000-memory.dmpFilesize
356KB
-
memory/652-117-0x000000000A160000-0x000000000A161000-memory.dmpFilesize
4KB
-
memory/652-118-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/652-119-0x00000000057D0000-0x00000000057D1000-memory.dmpFilesize
4KB
-
memory/652-120-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB
-
memory/652-121-0x0000000005CA0000-0x0000000005CA2000-memory.dmpFilesize
8KB
-
memory/652-122-0x0000000007D00000-0x0000000007D01000-memory.dmpFilesize
4KB
-
memory/652-123-0x0000000005F50000-0x0000000005FCA000-memory.dmpFilesize
488KB
-
memory/652-124-0x0000000005EC0000-0x0000000005EF8000-memory.dmpFilesize
224KB
-
memory/1628-125-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1628-126-0x000000000043761E-mapping.dmp
-
memory/1628-131-0x0000000004EC0000-0x00000000053BE000-memory.dmpFilesize
5.0MB
-
memory/1628-132-0x0000000005370000-0x0000000005371000-memory.dmpFilesize
4KB
-
memory/1628-133-0x0000000005B20000-0x0000000005B21000-memory.dmpFilesize
4KB