Analysis
- max time kernel
144s - max time network
112s - platform
windows10_x64 - resource
win10v20210408 - submitted
30/07/2021, 11:18
General
- Target Aggiornamento ordine Quantità__BFM Srl 117-28050-01.exe
- Size 1.3MB
- Sample210730-rnrw9qdfv2
- SHA256 540bb22ebba63642369ea8ff2d1c87db348926c8d0dee112bb883c0148447237
Malware Config
Extracted
-
agenttesla
-
https://api.telegram.org/bot1360033246:AAF6H8m6YrL09doyxtsvJzZ_cIl__BCF4aU/sendDocument
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 3 IoCs
- CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Aggiornamento ordine Quantità__BFM Srl 117-28050-01.exe"C:\Users\Admin\AppData\Local\Temp\Aggiornamento ordine Quantità__BFM Srl 117-28050-01.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Aggiornamento ordine Quantità__BFM Srl 117-28050-01.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/764-114-0x0000000000D80000-0x0000000000D81000-memory.dmp
memory/764-116-0x00000000057A0000-0x00000000057A1000-memory.dmp
memory/764-117-0x0000000005D40000-0x0000000005D41000-memory.dmp
memory/764-118-0x0000000005840000-0x0000000005841000-memory.dmp
memory/764-119-0x0000000005750000-0x0000000005751000-memory.dmp
memory/764-120-0x00000000056D0000-0x00000000056D1000-memory.dmp
memory/764-121-0x0000000005A00000-0x0000000005A01000-memory.dmp
memory/764-122-0x00000000051A0000-0x00000000051AB000-memory.dmp
memory/764-123-0x0000000007D40000-0x0000000007DD1000-memory.dmp
memory/764-124-0x0000000007DF0000-0x0000000007E27000-memory.dmp
memory/2256-239-0x00000000055B0000-0x00000000055B1000-memory.dmp
memory/2256-126-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2256-138-0x00000000053F0000-0x00000000058EE000-memory.dmp
memory/3140-137-0x00000000068F0000-0x00000000068F1000-memory.dmp
memory/3140-144-0x0000000007F60000-0x0000000007F61000-memory.dmp
memory/3140-135-0x0000000006F30000-0x0000000006F31000-memory.dmp
memory/3140-133-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
memory/3140-139-0x00000000068F2000-0x00000000068F3000-memory.dmp
memory/3140-140-0x0000000006D40000-0x0000000006D41000-memory.dmp
memory/3140-141-0x0000000007660000-0x0000000007661000-memory.dmp
memory/3140-142-0x00000000076D0000-0x00000000076D1000-memory.dmp
memory/3140-143-0x0000000006F10000-0x0000000006F11000-memory.dmp
memory/3140-136-0x0000000006CA0000-0x0000000006CA1000-memory.dmp
memory/3140-145-0x0000000007D70000-0x0000000007D71000-memory.dmp
memory/3140-153-0x0000000008D10000-0x0000000008D43000-memory.dmp
memory/3140-160-0x0000000008CF0000-0x0000000008CF1000-memory.dmp
memory/3140-165-0x0000000008E50000-0x0000000008E51000-memory.dmp
memory/3140-166-0x0000000009010000-0x0000000009011000-memory.dmp
memory/3140-167-0x000000007EBF0000-0x000000007EBF1000-memory.dmp
memory/3140-168-0x00000000068F3000-0x00000000068F4000-memory.dmp
memory/3140-363-0x0000000006940000-0x0000000006941000-memory.dmp
memory/3140-369-0x0000000006930000-0x0000000006931000-memory.dmp