Analysis
- max time kernel
140s - max time network
135s - platform
windows10_x64 - resource
win10-en - submitted
02/09/2021, 12:26
General
- Target Inquiry Sheet xls.exe
- Size 664KB
- Sample210902-ws6bpg45bx
- SHA256 39a29076dcbc4e24ca1f0c2ad1abd16d136929c67bf52c5fae71023f77c54cf1
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.palletsolutions.ca
-
Port
587
-
Username
-
Password
h~Q+QV.(M2?!
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- Looks for VMWare Tools registry key 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Inquiry Sheet xls.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry Sheet xls.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Inquiry Sheet xls.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IxosHS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp957F.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Inquiry Sheet xls.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry Sheet xls.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Inquiry Sheet xls.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry Sheet xls.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2156-147-0x0000000008850000-0x0000000008851000-memory.dmp
memory/2156-162-0x00000000097E0000-0x00000000097E1000-memory.dmp
memory/2156-369-0x0000000009AA0000-0x0000000009AA1000-memory.dmp
memory/2156-363-0x0000000009AB0000-0x0000000009AB1000-memory.dmp
memory/2156-238-0x0000000004E43000-0x0000000004E44000-memory.dmp
memory/2156-169-0x0000000009B20000-0x0000000009B21000-memory.dmp
memory/2156-168-0x000000007E5E0000-0x000000007E5E1000-memory.dmp
memory/2156-167-0x0000000009940000-0x0000000009941000-memory.dmp
memory/2156-155-0x0000000009800000-0x0000000009833000-memory.dmp
memory/2156-143-0x0000000004E42000-0x0000000004E43000-memory.dmp
memory/2156-130-0x00000000078C0000-0x00000000078C1000-memory.dmp
memory/2156-146-0x00000000089C0000-0x00000000089C1000-memory.dmp
memory/2156-131-0x00000000077A0000-0x00000000077A1000-memory.dmp
memory/2156-145-0x00000000080D0000-0x00000000080D1000-memory.dmp
memory/2156-133-0x0000000007840000-0x0000000007841000-memory.dmp
memory/2156-142-0x0000000004E40000-0x0000000004E41000-memory.dmp
memory/2156-139-0x0000000008180000-0x0000000008181000-memory.dmp
memory/2156-129-0x0000000004D20000-0x0000000004D21000-memory.dmp
memory/3972-144-0x0000000005880000-0x0000000005881000-memory.dmp
memory/3972-134-0x0000000000400000-0x000000000043C000-memory.dmp
memory/3972-388-0x0000000005881000-0x0000000005882000-memory.dmp
memory/3972-384-0x0000000005D20000-0x0000000005D21000-memory.dmp
memory/4000-123-0x0000000007840000-0x000000000789D000-memory.dmp
memory/4000-126-0x000000000D260000-0x000000000D261000-memory.dmp
memory/4000-124-0x0000000009FB0000-0x0000000009FE8000-memory.dmp
memory/4000-118-0x0000000005480000-0x0000000005481000-memory.dmp
memory/4000-122-0x00000000053E0000-0x00000000058DE000-memory.dmp
memory/4000-121-0x0000000006EE0000-0x0000000006EE1000-memory.dmp
memory/4000-120-0x0000000005610000-0x0000000005626000-memory.dmp
memory/4000-119-0x0000000005400000-0x0000000005401000-memory.dmp
memory/4000-115-0x0000000000B00000-0x0000000000B01000-memory.dmp
memory/4000-117-0x00000000058E0000-0x00000000058E1000-memory.dmp