Analysis

  • max time kernel
    141s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    27-07-2021 15:28

General

  • Target

    Images.exe

  • Size

    973KB

  • MD5

    82489381d072392f3075161bbb1ec8b8

  • SHA1

    5ac44b1ad6d31f14e22013792aed5033af1bed97

  • SHA256

    2307054debb98d7c9ca5b5fbce5ca1210c49563dbe01d2fa28cc24099a2db022

  • SHA512

    e53d7c446b87211327033139b6d0b539ed7aa0d2db660eaa44ad3d96499a03a26e96a887c47250c7ee685ae7a7bd3cc71aa49097c10ba6371f928a2cdf2c402d

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.nuntai-tw.com
  • Port:
    587
  • Username:
    greta@nuntai-tw.com
  • Password:
    tanga333

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Images.exe
    "C:\Users\Admin\AppData\Local\Temp\Images.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4048
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\THigGvOw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp888A.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4068
    • C:\Users\Admin\AppData\Local\Temp\Images.exe
      "C:\Users\Admin\AppData\Local\Temp\Images.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1236

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Images.exe.log
    MD5

    90acfd72f14a512712b1a7380c0faf60

    SHA1

    40ba4accb8faa75887e84fb8e38d598dc8cf0f12

    SHA256

    20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86

    SHA512

    29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9

  • C:\Users\Admin\AppData\Local\Temp\tmp888A.tmp
    MD5

    58b445ff6ec786da9db0005454c66e1e

    SHA1

    24e733b99d95f6effdd1fe652733cbbcf305eb10

    SHA256

    8de6ca30ef6619b639fb9e20721bdd295885484f5af52a9a881eb4a753adefbb

    SHA512

    7f8c915a832e7861920d16af61be3db7f5efc1ee825ae4df8bfdfe721639c51359731d558b98efeee163a11b556b8131f6dad3d348ad6f1011fe4efac905714b

  • memory/1236-136-0x0000000005FD0000-0x0000000005FD1000-memory.dmp
    Filesize

    4KB

  • memory/1236-135-0x00000000056E0000-0x00000000056E1000-memory.dmp
    Filesize

    4KB

  • memory/1236-134-0x0000000005270000-0x000000000576E000-memory.dmp
    Filesize

    5.0MB

  • memory/1236-128-0x0000000000436CFE-mapping.dmp
  • memory/1236-127-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

  • memory/4048-119-0x0000000005120000-0x0000000005121000-memory.dmp
    Filesize

    4KB

  • memory/4048-123-0x000000000ADE0000-0x000000000AE55000-memory.dmp
    Filesize

    468KB

  • memory/4048-124-0x0000000005200000-0x000000000523B000-memory.dmp
    Filesize

    236KB

  • memory/4048-122-0x0000000005260000-0x000000000528D000-memory.dmp
    Filesize

    180KB

  • memory/4048-121-0x00000000050A0000-0x000000000513C000-memory.dmp
    Filesize

    624KB

  • memory/4048-120-0x00000000053A0000-0x00000000053A1000-memory.dmp
    Filesize

    4KB

  • memory/4048-114-0x0000000000810000-0x0000000000811000-memory.dmp
    Filesize

    4KB

  • memory/4048-118-0x0000000005300000-0x0000000005301000-memory.dmp
    Filesize

    4KB

  • memory/4048-117-0x0000000005760000-0x0000000005761000-memory.dmp
    Filesize

    4KB

  • memory/4048-116-0x0000000005140000-0x0000000005141000-memory.dmp
    Filesize

    4KB

  • memory/4068-125-0x0000000000000000-mapping.dmp