Analysis

  • max time kernel
    122s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    27-07-2021 19:38

General

  • Target

    #$$$!1weF5(1).exe

  • Size

    662KB

  • MD5

    65c520abdacd8aacdb7f93ed7b00d716

  • SHA1

    c5ca68ab7ce2e46e0b924acb0365af5f4935847d

  • SHA256

    b47c11b0e48a16e4e1d861dcb524bf3bcabfe1481853b7d94fb738f635d1d5aa

  • SHA512

    f369b973656103610c08a054ae50a3ddcccc9aa64acfc9fec9d6e06b5f6cd3d5e3ca2d7b62eda5838452efd0bed8f25f8a9cb9fe430c9ec39749181e24be93ed

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1815802853:AAFwTZ6mRU-UOmcTcCR8glZAAkNmzHpMkL8/sendDocument

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\#$$$!1weF5(1).exe
    "C:\Users\Admin\AppData\Local\Temp\#$$$!1weF5(1).exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:564
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1180
      • C:\Windows\SysWOW64\PING.EXE
        "C:\Windows\system32\PING.EXE" gooogle.com
        3⤵
        • Runs ping.exe
        PID:1148
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3848
      • C:\Windows\SysWOW64\PING.EXE
        "C:\Windows\system32\PING.EXE" gooogle.com
        3⤵
        • Runs ping.exe
        PID:3596
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2240
      • C:\Windows\SysWOW64\PING.EXE
        "C:\Windows\system32\PING.EXE" gooogle.com
        3⤵
        • Runs ping.exe
        PID:2408
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping gooogle.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3960
      • C:\Windows\SysWOW64\PING.EXE
        "C:\Windows\system32\PING.EXE" gooogle.com
        3⤵
        • Runs ping.exe
        PID:200
    • C:\Users\Admin\AppData\Local\Temp\#$$$!1weF5(1).exe
      C:\Users\Admin\AppData\Local\Temp\#$$$!1weF5(1).exe
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2296

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Collection

Data from Local System

3
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\#$$$!1weF5(1).exe.log
    MD5

    9e7845217df4a635ec4341c3d52ed685

    SHA1

    d65cb39d37392975b038ce503a585adadb805da5

    SHA256

    d60e596ed3d5c13dc9f1660e6d870d99487e1383891437645c4562a9ecaa8c9b

    SHA512

    307c3b4d4f2655bdeb177e7b9c981ca27513618903f02c120caa755c9da5a8dd03ebab660b56108a680720a97c1e9596692490aede18cc4bd77b9fc3d8e68aa1

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
    MD5

    0f5cbdca905beb13bebdcf43fb0716bd

    SHA1

    9e136131389fde83297267faf6c651d420671b3f

    SHA256

    a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060

    SHA512

    a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    MD5

    cb29bb8becf862f3c6f49b32ac46ae52

    SHA1

    64a6304c20049740e1df9d0c01e31ea96ec5be2f

    SHA256

    e5213677c082bcd30d85528a7cbb37bd01aca77ab655010c752ecc12943edc76

    SHA512

    72fa338c19e2f7bcb878b829dbae5d9cc659482ffb156ac724f8015ebd1c4652b99eb41c14c3672e94767be778bac8be6a48fb94d79920656a62276b7b13f12d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    MD5

    cb29bb8becf862f3c6f49b32ac46ae52

    SHA1

    64a6304c20049740e1df9d0c01e31ea96ec5be2f

    SHA256

    e5213677c082bcd30d85528a7cbb37bd01aca77ab655010c752ecc12943edc76

    SHA512

    72fa338c19e2f7bcb878b829dbae5d9cc659482ffb156ac724f8015ebd1c4652b99eb41c14c3672e94767be778bac8be6a48fb94d79920656a62276b7b13f12d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    MD5

    12e1f6f5893b592f7ba6987536e95fa7

    SHA1

    9f1309d686fe8bbbcbc9d27488e2a4b30ad1f1e2

    SHA256

    e987e39e274773b8e28b8c36706024ab1063489534e4e6d075c45d0a571b90a6

    SHA512

    217106b519709f6130ed98160224ba6dfd07f3b651e05aa862c1edc995d41bf7a1ffbcb00cd591095f08014731fdbd92743e03f3d89b80052fd918929e8211aa

  • memory/200-193-0x0000000000000000-mapping.dmp
  • memory/564-120-0x00000000056A0000-0x0000000005B9E000-memory.dmp
    Filesize

    4MB

  • memory/564-199-0x0000000009790000-0x00000000097FB000-memory.dmp
    Filesize

    428KB

  • memory/564-194-0x0000000007210000-0x0000000007265000-memory.dmp
    Filesize

    340KB

  • memory/564-119-0x00000000056E0000-0x00000000056E1000-memory.dmp
    Filesize

    4KB

  • memory/564-118-0x00000000056A0000-0x0000000005B9E000-memory.dmp
    Filesize

    4MB

  • memory/564-117-0x0000000005740000-0x0000000005741000-memory.dmp
    Filesize

    4KB

  • memory/564-116-0x0000000005BA0000-0x0000000005BA1000-memory.dmp
    Filesize

    4KB

  • memory/564-114-0x0000000000CC0000-0x0000000000CC1000-memory.dmp
    Filesize

    4KB

  • memory/1148-135-0x0000000000000000-mapping.dmp
  • memory/1180-152-0x0000000006C84000-0x0000000006C86000-memory.dmp
    Filesize

    8KB

  • memory/1180-126-0x0000000006C80000-0x0000000006C81000-memory.dmp
    Filesize

    4KB

  • memory/1180-134-0x0000000007C40000-0x0000000007C41000-memory.dmp
    Filesize

    4KB

  • memory/1180-132-0x0000000001040000-0x0000000001041000-memory.dmp
    Filesize

    4KB

  • memory/1180-121-0x0000000000000000-mapping.dmp
  • memory/1180-124-0x00000000012B0000-0x00000000012B1000-memory.dmp
    Filesize

    4KB

  • memory/1180-125-0x00000000072C0000-0x00000000072C1000-memory.dmp
    Filesize

    4KB

  • memory/1180-151-0x0000000006C83000-0x0000000006C84000-memory.dmp
    Filesize

    4KB

  • memory/1180-131-0x00000000078F0000-0x00000000078F1000-memory.dmp
    Filesize

    4KB

  • memory/1180-133-0x0000000006EF0000-0x0000000006EF1000-memory.dmp
    Filesize

    4KB

  • memory/1180-130-0x0000000006FD0000-0x0000000006FD1000-memory.dmp
    Filesize

    4KB

  • memory/1180-129-0x0000000006F60000-0x0000000006F61000-memory.dmp
    Filesize

    4KB

  • memory/1180-127-0x0000000006C82000-0x0000000006C83000-memory.dmp
    Filesize

    4KB

  • memory/1180-128-0x0000000006EC0000-0x0000000006EC1000-memory.dmp
    Filesize

    4KB

  • memory/2240-177-0x0000000004874000-0x0000000004876000-memory.dmp
    Filesize

    8KB

  • memory/2240-168-0x0000000004870000-0x0000000004871000-memory.dmp
    Filesize

    4KB

  • memory/2240-169-0x0000000004872000-0x0000000004873000-memory.dmp
    Filesize

    4KB

  • memory/2240-157-0x0000000000000000-mapping.dmp
  • memory/2240-176-0x0000000004873000-0x0000000004874000-memory.dmp
    Filesize

    4KB

  • memory/2296-200-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

  • memory/2296-207-0x0000000005670000-0x0000000005B6E000-memory.dmp
    Filesize

    4MB

  • memory/2296-211-0x0000000006360000-0x0000000006361000-memory.dmp
    Filesize

    4KB

  • memory/2296-206-0x0000000005870000-0x0000000005871000-memory.dmp
    Filesize

    4KB

  • memory/2296-201-0x000000000043773E-mapping.dmp
  • memory/2408-174-0x0000000000000000-mapping.dmp
  • memory/3596-153-0x0000000000000000-mapping.dmp
  • memory/3848-146-0x0000000003732000-0x0000000003733000-memory.dmp
    Filesize

    4KB

  • memory/3848-145-0x0000000003730000-0x0000000003731000-memory.dmp
    Filesize

    4KB

  • memory/3848-167-0x0000000003734000-0x0000000003736000-memory.dmp
    Filesize

    8KB

  • memory/3848-136-0x0000000000000000-mapping.dmp
  • memory/3848-166-0x0000000003733000-0x0000000003734000-memory.dmp
    Filesize

    4KB

  • memory/3960-191-0x0000000007242000-0x0000000007243000-memory.dmp
    Filesize

    4KB

  • memory/3960-190-0x0000000007240000-0x0000000007241000-memory.dmp
    Filesize

    4KB

  • memory/3960-210-0x0000000007244000-0x0000000007246000-memory.dmp
    Filesize

    8KB

  • memory/3960-209-0x0000000007243000-0x0000000007244000-memory.dmp
    Filesize

    4KB

  • memory/3960-178-0x0000000000000000-mapping.dmp