Analysis
-
max time kernel
143s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
28-09-2021 08:28
General
-
Target
RFQ_99705546,99805546_Mark Cansick.exe
-
Size
567KB
-
MD5
724bce9be00d521c9ae6075d50434b11
-
SHA1
a95a26499d30f48ca0b23e17b7273b1e6b92f8ac
-
SHA256
94bc5b095176ccf49917563287006f3efd903cac47d48e251f4f4554ee87c990
-
SHA512
d4082a9eca3f687eef2a1873368d89afcdf88461c24c6e0378e7925000562800a02dd6194fa81fb0b1150114a5451cba6b168739ae2d389efe0b82613b4d50ba
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
smtp.regalbelloit.com - Port:
587 - Username:
user@regalbelloit.com - Password:
OccWNGh9
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ_99705546,99805546_Mark Cansick.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_99705546,99805546_Mark Cansick.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RFQ_99705546,99805546_Mark Cansick.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sucEaYWuNda" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCCFF.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\RFQ_99705546,99805546_Mark Cansick.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_99705546,99805546_Mark Cansick.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/900-131-0x0000000000000000-mapping.dmp
-
memory/1004-387-0x00000000053D1000-0x00000000053D2000-memory.dmpFilesize
4KB
-
memory/1004-363-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/1004-145-0x00000000053D0000-0x00000000053D1000-memory.dmpFilesize
4KB
-
memory/1004-134-0x000000000043787E-mapping.dmp
-
memory/1004-133-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3572-146-0x0000000007D00000-0x0000000007D01000-memory.dmpFilesize
4KB
-
memory/3572-167-0x000000007EFD0000-0x000000007EFD1000-memory.dmpFilesize
4KB
-
memory/3572-370-0x0000000008F70000-0x0000000008F71000-memory.dmpFilesize
4KB
-
memory/3572-124-0x0000000000000000-mapping.dmp
-
memory/3572-362-0x0000000008F80000-0x0000000008F81000-memory.dmpFilesize
4KB
-
memory/3572-128-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/3572-129-0x0000000007040000-0x0000000007041000-memory.dmpFilesize
4KB
-
memory/3572-130-0x0000000006C70000-0x0000000006C71000-memory.dmpFilesize
4KB
-
memory/3572-235-0x0000000000F73000-0x0000000000F74000-memory.dmpFilesize
4KB
-
memory/3572-132-0x0000000006D10000-0x0000000006D11000-memory.dmpFilesize
4KB
-
memory/3572-168-0x0000000008FD0000-0x0000000008FD1000-memory.dmpFilesize
4KB
-
memory/3572-166-0x0000000008E10000-0x0000000008E11000-memory.dmpFilesize
4KB
-
memory/3572-137-0x0000000000F70000-0x0000000000F71000-memory.dmpFilesize
4KB
-
memory/3572-139-0x0000000000F72000-0x0000000000F73000-memory.dmpFilesize
4KB
-
memory/3572-141-0x0000000007670000-0x0000000007671000-memory.dmpFilesize
4KB
-
memory/3572-143-0x0000000006E80000-0x0000000006E81000-memory.dmpFilesize
4KB
-
memory/3572-144-0x0000000007F90000-0x0000000007F91000-memory.dmpFilesize
4KB
-
memory/3572-161-0x0000000008CA0000-0x0000000008CA1000-memory.dmpFilesize
4KB
-
memory/3572-154-0x0000000008CE0000-0x0000000008D13000-memory.dmpFilesize
204KB
-
memory/3628-114-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/3628-118-0x0000000004BF0000-0x00000000050EE000-memory.dmpFilesize
5.0MB
-
memory/3628-119-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/3628-122-0x00000000058E0000-0x0000000005946000-memory.dmpFilesize
408KB
-
memory/3628-120-0x0000000004EF0000-0x0000000004EF1000-memory.dmpFilesize
4KB
-
memory/3628-121-0x0000000004CA0000-0x0000000004CAE000-memory.dmpFilesize
56KB
-
memory/3628-125-0x0000000005D60000-0x0000000005D61000-memory.dmpFilesize
4KB
-
memory/3628-117-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/3628-123-0x0000000005A70000-0x0000000005AA9000-memory.dmpFilesize
228KB
-
memory/3628-116-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB