Analysis

  • max time kernel
    143s
  • max time network
    156s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    18-10-2021 11:33

General

  • Target

    [Schedule_&_Booking__18th_oct.exe

  • Size

    525KB

  • MD5

    4114e15de65a9ec4b8eacc3ef60804bb

  • SHA1

    eb450264abe3b3ed70167f267cb974ea13d60260

  • SHA256

    d81e35754aa34fb2fd0b850b4f1d8080a64a8408623303d3a8abecea5b0a30de

  • SHA512

    256e27521a7008896808a798222025769a00aa155148e843a959c969bb9b7e369a4d57f5d1605fe4c1d1f0704c675df638eea032f602c51d1fb78e2af8e6805c

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.mail.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    PxhrKDkvikRcSaP2dkv9

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

C2

grace.adds-only.xyz:1609

Mutex

VNM_MUTEX_c2q7y2ayYutZ2XaYe7

Attributes
  • encryption_key

    wHq4o3k6UfKZv19jkcxs

  • install_name

    winrara.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Venom Client Startup

  • subdirectory

    SubDir

Extracted

Family

quasar

Mutex

Attributes
  • encryption_key

  • install_name

  • log_directory

  • reconnect_delay

    3000

  • startup_key

  • subdirectory

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Contains code to disable Windows Defender 3 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Quasar Payload 3 IoCs
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • AgentTesla Payload 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[Schedule_&_Booking__18th_oct.exe
    "C:\Users\Admin\AppData\Local\Temp\[Schedule_&_Booking__18th_oct.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3580
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\[Schedule_&_Booking__18th_oct.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3124
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\swqpSTZh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp47A4.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2764
    • C:\Users\Admin\AppData\Local\Temp\[Schedule_&_Booking__18th_oct.exe
      "C:\Users\Admin\AppData\Local\Temp\[Schedule_&_Booking__18th_oct.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:2492
      • C:\Users\Admin\AppData\Local\Temp\apps.exe
        "C:\Users\Admin\AppData\Local\Temp\apps.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3244
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\apps.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4952
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kCCzCqEnSxl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp96D8.tmp"
          4⤵
          • Creates scheduled task(s)
          PID:4992
        • C:\Users\Admin\AppData\Local\Temp\apps.exe
          "C:\Users\Admin\AppData\Local\Temp\apps.exe"
          4⤵
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5012
          • C:\Users\Admin\AppData\Roaming\SubDir\winrara.exe
            "C:\Users\Admin\AppData\Roaming\SubDir\winrara.exe"
            5⤵
            • Executes dropped EXE
            PID:312
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "powershell" Get-MpPreference -verbose
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1212
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4668
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
              6⤵
                PID:1840

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\[Schedule_&_Booking__18th_oct.exe.log

      MD5

      0c2899d7c6746f42d5bbe088c777f94c

      SHA1

      622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

      SHA256

      5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

      SHA512

      ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      MD5

      e33ed3d4cc9b2e5a08ae25747ef47620

      SHA1

      e2f4cfdd39bcb2eb1c05648a37a3d8536eaf19b7

      SHA256

      0e7093450fb6bb5201b4291033daf6099881421ab47b122972e0249ef5b45a4f

      SHA512

      9e990f7ca202c7ecc7a21dd2433055b71bd62f2e524f4702b674316effeb8fa37e891d40f3e6a960380dd7967033c7a7f235e73a3c434e97495e532309b4f95e

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      MD5

      c70e4b5825918cbc47e09aea453a7c0f

      SHA1

      46ad45a466dd2b8f13a709c56aa1db358ab1f6f0

      SHA256

      afca90177e26355a52373f8c739ad1ed734422be9362e75dd64f483abc247aaa

      SHA512

      f2d6c0d09cdc9c10b13828f22e915d08ef058d8835abfc46824a8db35f83ea293500734f8f2e378dc79e130396ba3a6f2b67fe984e9312bba93294b2b55d9d75

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      MD5

      131215bb95839443c3ce951a7936e2b3

      SHA1

      a3bca56801e757622056a85b0390554a3b8bfc36

      SHA256

      7f3aff5800fb18de32d75289dd8f82379cd0e9bf1b5abbfa9ebdce94e66cd72a

      SHA512

      de648270b7ca719b94a130b21bac04e1e8ba69d4408afb7fe34b6111e65294c0862c50d98a067d83e044930b0aaac4a83671ccf08372cbf006387974141c61e6

    • C:\Users\Admin\AppData\Local\Temp\apps.exe

      MD5

      1b465c6989637df1d5c511919c43e457

      SHA1

      317f8bf5133176cd0f4125c6f2f0fdfc226754ab

      SHA256

      0b196e6b27ed15410bd946b1ccfd1de6b7af64a540cd0226b8eb9bd742d1b095

      SHA512

      e9dfd465ee22ebf67a73fdd873440d73f013b064e2a4aff3aedad2c5bd1b3027284af7912a383ad6c0a91ef8caad2b3c69cdfd29edb638563d89fd7e89e114dc

    • C:\Users\Admin\AppData\Local\Temp\apps.exe

      MD5

      1b465c6989637df1d5c511919c43e457

      SHA1

      317f8bf5133176cd0f4125c6f2f0fdfc226754ab

      SHA256

      0b196e6b27ed15410bd946b1ccfd1de6b7af64a540cd0226b8eb9bd742d1b095

      SHA512

      e9dfd465ee22ebf67a73fdd873440d73f013b064e2a4aff3aedad2c5bd1b3027284af7912a383ad6c0a91ef8caad2b3c69cdfd29edb638563d89fd7e89e114dc

    • C:\Users\Admin\AppData\Local\Temp\apps.exe

      MD5

      1b465c6989637df1d5c511919c43e457

      SHA1

      317f8bf5133176cd0f4125c6f2f0fdfc226754ab

      SHA256

      0b196e6b27ed15410bd946b1ccfd1de6b7af64a540cd0226b8eb9bd742d1b095

      SHA512

      e9dfd465ee22ebf67a73fdd873440d73f013b064e2a4aff3aedad2c5bd1b3027284af7912a383ad6c0a91ef8caad2b3c69cdfd29edb638563d89fd7e89e114dc

    • C:\Users\Admin\AppData\Roaming\SubDir\winrara.exe

      MD5

      1b465c6989637df1d5c511919c43e457

      SHA1

      317f8bf5133176cd0f4125c6f2f0fdfc226754ab

      SHA256

      0b196e6b27ed15410bd946b1ccfd1de6b7af64a540cd0226b8eb9bd742d1b095

      SHA512

      e9dfd465ee22ebf67a73fdd873440d73f013b064e2a4aff3aedad2c5bd1b3027284af7912a383ad6c0a91ef8caad2b3c69cdfd29edb638563d89fd7e89e114dc

    • C:\Users\Admin\AppData\Roaming\SubDir\winrara.exe

      MD5

      1b465c6989637df1d5c511919c43e457

      SHA1

      317f8bf5133176cd0f4125c6f2f0fdfc226754ab

      SHA256

      0b196e6b27ed15410bd946b1ccfd1de6b7af64a540cd0226b8eb9bd742d1b095

      SHA512

      e9dfd465ee22ebf67a73fdd873440d73f013b064e2a4aff3aedad2c5bd1b3027284af7912a383ad6c0a91ef8caad2b3c69cdfd29edb638563d89fd7e89e114dc

    • memory/312-246-0x0000000007B10000-0x000000000800E000-memory.dmp

      Filesize

      5.0MB

    • memory/312-204-0x0000000000000000-mapping.dmp

    • memory/1212-349-0x000000007F030000-0x000000007F031000-memory.dmp

      Filesize

      4KB

    • memory/1212-206-0x0000000000000000-mapping.dmp

    • memory/1212-215-0x00000000007B0000-0x00000000007B1000-memory.dmp

      Filesize

      4KB

    • memory/1212-244-0x00000000007B2000-0x00000000007B3000-memory.dmp

      Filesize

      4KB

    • memory/1212-352-0x00000000007B3000-0x00000000007B4000-memory.dmp

      Filesize

      4KB

    • memory/1840-704-0x0000000000000000-mapping.dmp

    • memory/2492-129-0x000000000043780E-mapping.dmp

    • memory/2492-126-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/2492-160-0x0000000005910000-0x0000000005911000-memory.dmp

      Filesize

      4KB

    • memory/2492-138-0x00000000054B0000-0x00000000059AE000-memory.dmp

      Filesize

      5.0MB

    • memory/2492-699-0x00000000054B0000-0x00000000059AE000-memory.dmp

      Filesize

      5.0MB

    • memory/2764-125-0x0000000000000000-mapping.dmp

    • memory/3124-136-0x0000000006A10000-0x0000000006A11000-memory.dmp

      Filesize

      4KB

    • memory/3124-140-0x0000000006DD0000-0x0000000006DD1000-memory.dmp

      Filesize

      4KB

    • memory/3124-145-0x0000000008090000-0x0000000008091000-memory.dmp

      Filesize

      4KB

    • memory/3124-146-0x0000000007EC0000-0x0000000007EC1000-memory.dmp

      Filesize

      4KB

    • memory/3124-147-0x00000000009F0000-0x00000000009F1000-memory.dmp

      Filesize

      4KB

    • memory/3124-157-0x00000000009F0000-0x00000000009F1000-memory.dmp

      Filesize

      4KB

    • memory/3124-158-0x0000000006A13000-0x0000000006A14000-memory.dmp

      Filesize

      4KB

    • memory/3124-159-0x0000000006A14000-0x0000000006A16000-memory.dmp

      Filesize

      8KB

    • memory/3124-143-0x00000000077B0000-0x00000000077B1000-memory.dmp

      Filesize

      4KB

    • memory/3124-124-0x0000000000000000-mapping.dmp

    • memory/3124-142-0x0000000006E80000-0x0000000006E81000-memory.dmp

      Filesize

      4KB

    • memory/3124-141-0x00000000076F0000-0x00000000076F1000-memory.dmp

      Filesize

      4KB

    • memory/3124-144-0x00000000076A0000-0x00000000076A1000-memory.dmp

      Filesize

      4KB

    • memory/3124-127-0x00000000009F0000-0x00000000009F1000-memory.dmp

      Filesize

      4KB

    • memory/3124-128-0x00000000009F0000-0x00000000009F1000-memory.dmp

      Filesize

      4KB

    • memory/3124-131-0x0000000004360000-0x0000000004361000-memory.dmp

      Filesize

      4KB

    • memory/3124-134-0x0000000007050000-0x0000000007051000-memory.dmp

      Filesize

      4KB

    • memory/3124-137-0x0000000006A12000-0x0000000006A13000-memory.dmp

      Filesize

      4KB

    • memory/3244-165-0x0000000000300000-0x0000000000301000-memory.dmp

      Filesize

      4KB

    • memory/3244-173-0x0000000009410000-0x00000000094B8000-memory.dmp

      Filesize

      672KB

    • memory/3244-162-0x0000000000000000-mapping.dmp

    • memory/3244-170-0x0000000007010000-0x000000000750E000-memory.dmp

      Filesize

      5.0MB

    • memory/3580-117-0x0000000007340000-0x0000000007341000-memory.dmp

      Filesize

      4KB

    • memory/3580-118-0x0000000006EE0000-0x0000000006EE1000-memory.dmp

      Filesize

      4KB

    • memory/3580-119-0x0000000006ED0000-0x0000000006ED1000-memory.dmp

      Filesize

      4KB

    • memory/3580-115-0x0000000000130000-0x0000000000131000-memory.dmp

      Filesize

      4KB

    • memory/3580-120-0x0000000009370000-0x0000000009371000-memory.dmp

      Filesize

      4KB

    • memory/3580-121-0x00000000092D0000-0x00000000092D8000-memory.dmp

      Filesize

      32KB

    • memory/3580-122-0x0000000006E40000-0x000000000733E000-memory.dmp

      Filesize

      5.0MB

    • memory/3580-123-0x0000000008C10000-0x0000000008C69000-memory.dmp

      Filesize

      356KB

    • memory/4668-703-0x0000000000000000-mapping.dmp

    • memory/4952-174-0x0000000000000000-mapping.dmp

    • memory/4952-191-0x0000000007570000-0x0000000007571000-memory.dmp

      Filesize

      4KB

    • memory/4952-180-0x00000000005A0000-0x00000000005A1000-memory.dmp

      Filesize

      4KB

    • memory/4952-199-0x00000000005A0000-0x00000000005A1000-memory.dmp

      Filesize

      4KB

    • memory/4952-181-0x00000000005A0000-0x00000000005A1000-memory.dmp

      Filesize

      4KB

    • memory/4952-196-0x00000000041E2000-0x00000000041E3000-memory.dmp

      Filesize

      4KB

    • memory/4952-247-0x000000007FD80000-0x000000007FD81000-memory.dmp

      Filesize

      4KB

    • memory/4952-249-0x00000000041E3000-0x00000000041E4000-memory.dmp

      Filesize

      4KB

    • memory/4952-195-0x00000000041E0000-0x00000000041E1000-memory.dmp

      Filesize

      4KB

    • memory/4952-194-0x00000000079E0000-0x00000000079E1000-memory.dmp

      Filesize

      4KB

    • memory/4992-175-0x0000000000000000-mapping.dmp

    • memory/5012-177-0x0000000000486C1E-mapping.dmp

    • memory/5012-197-0x0000000004F60000-0x000000000545E000-memory.dmp

      Filesize

      5.0MB

    • memory/5012-176-0x0000000000400000-0x000000000048C000-memory.dmp

      Filesize

      560KB