Analysis

  • max time kernel
    150s
  • max time network
    113s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    06/08/2021, 13:45

General

  • Target

    BL#TELEX-SHIPMENT-POC76120.exe

  • Size

    838KB

  • MD5

    79076256e795c9399e830f1e4f0fe221

  • SHA1

    6bc1068223a0238b595bc6b9e145be9aaafea085

  • SHA256

    bd0328f6be16f7c73f39a16739960a069d4812943cfbc93000bbe2a3eed45039

  • SHA512

    3e056a19d0b3bd3227318f635a48ab9d7a1b1373f689a3d4be1b64e19815602209571618ebdc386f5fe072f00706fe17d48598b725f3e28a89b993d98326111a

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.themainreport.co.nz
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    -I;MGhTyL{AQ

Extracted

Family

oski

C2

fine.le-pearl.com

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • AgentTesla Payload 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BL#TELEX-SHIPMENT-POC76120.exe
    "C:\Users\Admin\AppData\Local\Temp\BL#TELEX-SHIPMENT-POC76120.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:664
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\BL#TELEX-SHIPMENT-POC76120.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1820
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\apZSuwq.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2088
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\apZSuwq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3AD7.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2112
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\apZSuwq.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3848
    • C:\Users\Admin\AppData\Local\Temp\BL#TELEX-SHIPMENT-POC76120.exe
      "C:\Users\Admin\AppData\Local\Temp\BL#TELEX-SHIPMENT-POC76120.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3932
      • C:\Users\Admin\AppData\Local\Temp\apwxc.exe
        "C:\Users\Admin\AppData\Local\Temp\apwxc.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3016
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\apwxc.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2540
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ImauUieIe.exe"
          4⤵
            PID:1280
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ImauUieIe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCF62.tmp"
            4⤵
            • Creates scheduled task(s)
            PID:1708
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ImauUieIe.exe"
            4⤵
              PID:4000
            • C:\Users\Admin\AppData\Local\Temp\apwxc.exe
              "C:\Users\Admin\AppData\Local\Temp\apwxc.exe"
              4⤵
                PID:2940

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/664-120-0x0000000007690000-0x0000000007691000-memory.dmp

                Filesize

                4KB

              • memory/664-123-0x0000000009E70000-0x0000000009EA9000-memory.dmp

                Filesize

                228KB

              • memory/664-122-0x00000000075F0000-0x0000000007682000-memory.dmp

                Filesize

                584KB

              • memory/664-121-0x00000000053D0000-0x00000000053E3000-memory.dmp

                Filesize

                76KB

              • memory/664-114-0x0000000000850000-0x0000000000851000-memory.dmp

                Filesize

                4KB

              • memory/664-119-0x00000000052F0000-0x00000000057EE000-memory.dmp

                Filesize

                5.0MB

              • memory/664-118-0x0000000005160000-0x0000000005161000-memory.dmp

                Filesize

                4KB

              • memory/664-117-0x00000000051C0000-0x00000000051C1000-memory.dmp

                Filesize

                4KB

              • memory/664-116-0x00000000057F0000-0x00000000057F1000-memory.dmp

                Filesize

                4KB

              • memory/1280-921-0x0000000006A42000-0x0000000006A43000-memory.dmp

                Filesize

                4KB

              • memory/1280-919-0x0000000006A40000-0x0000000006A41000-memory.dmp

                Filesize

                4KB

              • memory/1820-136-0x00000000045D2000-0x00000000045D3000-memory.dmp

                Filesize

                4KB

              • memory/1820-237-0x000000007E700000-0x000000007E701000-memory.dmp

                Filesize

                4KB

              • memory/1820-129-0x00000000044B0000-0x00000000044B1000-memory.dmp

                Filesize

                4KB

              • memory/1820-131-0x0000000007170000-0x0000000007171000-memory.dmp

                Filesize

                4KB

              • memory/1820-135-0x00000000045D0000-0x00000000045D1000-memory.dmp

                Filesize

                4KB

              • memory/1820-266-0x00000000045D3000-0x00000000045D4000-memory.dmp

                Filesize

                4KB

              • memory/2088-262-0x00000000041A3000-0x00000000041A4000-memory.dmp

                Filesize

                4KB

              • memory/2088-138-0x00000000041A2000-0x00000000041A3000-memory.dmp

                Filesize

                4KB

              • memory/2088-169-0x0000000007A00000-0x0000000007A01000-memory.dmp

                Filesize

                4KB

              • memory/2088-172-0x0000000007C60000-0x0000000007C61000-memory.dmp

                Filesize

                4KB

              • memory/2088-236-0x000000007F770000-0x000000007F771000-memory.dmp

                Filesize

                4KB

              • memory/2088-155-0x0000000007420000-0x0000000007421000-memory.dmp

                Filesize

                4KB

              • memory/2088-159-0x0000000006D80000-0x0000000006D81000-memory.dmp

                Filesize

                4KB

              • memory/2088-137-0x00000000041A0000-0x00000000041A1000-memory.dmp

                Filesize

                4KB

              • memory/2540-916-0x00000000042A0000-0x00000000042A1000-memory.dmp

                Filesize

                4KB

              • memory/2540-917-0x00000000042A2000-0x00000000042A3000-memory.dmp

                Filesize

                4KB

              • memory/3016-894-0x0000000004BE0000-0x00000000050DE000-memory.dmp

                Filesize

                5.0MB

              • memory/3848-151-0x00000000079E0000-0x00000000079E1000-memory.dmp

                Filesize

                4KB

              • memory/3848-162-0x00000000050B2000-0x00000000050B3000-memory.dmp

                Filesize

                4KB

              • memory/3848-260-0x00000000050B3000-0x00000000050B4000-memory.dmp

                Filesize

                4KB

              • memory/3848-158-0x00000000050B0000-0x00000000050B1000-memory.dmp

                Filesize

                4KB

              • memory/3848-166-0x00000000075F0000-0x00000000075F1000-memory.dmp

                Filesize

                4KB

              • memory/3848-163-0x00000000083B0000-0x00000000083B1000-memory.dmp

                Filesize

                4KB

              • memory/3848-235-0x000000007EF60000-0x000000007EF61000-memory.dmp

                Filesize

                4KB

              • memory/3848-197-0x0000000009A50000-0x0000000009A83000-memory.dmp

                Filesize

                204KB

              • memory/3932-141-0x0000000000400000-0x000000000043C000-memory.dmp

                Filesize

                240KB

              • memory/3932-154-0x00000000053B0000-0x00000000058AE000-memory.dmp

                Filesize

                5.0MB