Analysis

  • max time kernel
    129s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    18-10-2021 18:30

General

  • Target

    BND28384.exe

  • Size

    739KB

  • MD5

    91b12e9726457f2c6ad29b8b27bf7e3c

  • SHA1

    03406222c3cc95e03736a5844e31975b714758dd

  • SHA256

    e4a297a62797d50a37f87d75499be34639395d4791416d2be66c0e3c6a43a8d1

  • SHA512

    8e220ae8c5765fcb4cb65e5d04f4f7c296ecd22d6d81556bc4cf908b66e49210e8139e18b9a82f837870c390388d10f9cea2a575d46b6dc8dc574585500cb907

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.westviewcargos.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Choice@@@12345

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload 2 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs
  • Looks for VMWare Tools registry key 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BND28384.exe
    "C:\Users\Admin\AppData\Local\Temp\BND28384.exe"
    1⤵
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vwXKdwSIXtu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDA3F.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3044
    • C:\Users\Admin\AppData\Local\Temp\BND28384.exe
      "{path}"
      2⤵
        PID:928
      • C:\Users\Admin\AppData\Local\Temp\BND28384.exe
        "{path}"
        2⤵
          PID:2316
        • C:\Users\Admin\AppData\Local\Temp\BND28384.exe
          "{path}"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:940
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
            dw20.exe -x -s 704
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2108

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\BND28384.exe.log

        MD5

        04ed5246c6fe2244d2885e6654fa8361

        SHA1

        8d780ce3bba85141f9e2158c165b52487dd5823a

        SHA256

        ca114a622a02924b818488b080834d1b1367607fc29ab3105302b81457398ab5

        SHA512

        48698b1601477f3e50fde16f26f4b99246de7231e2d735f95f8974f3efded92436a47558d3bd5ea7e928e64b90ceaeaf0ab904c27ef5e83b7b7e6300be4b3d41

      • C:\Users\Admin\AppData\Local\Temp\tmpDA3F.tmp

        MD5

        d9fb81c91ff85ec11a8536bbb5c043a0

        SHA1

        3baa0ac7cd26929ca80061fc4d5e41675218b4ae

        SHA256

        184b9433065166b387a6cb2aae16b48e5460f4e9c6aaec2caf4ec6db682287f3

        SHA512

        746b9020314cfbb95d5dac27e46b000dc43879e7bb4d9ceda7c402c7ef9ba24fb0d63efa6277300b193c8076370605586832a21382950ac10ce39b7bdf6a15df

      • memory/940-119-0x0000000000400000-0x000000000043C000-memory.dmp

        Filesize

        240KB

      • memory/940-120-0x00000000004377EE-mapping.dmp

      • memory/940-123-0x0000000001210000-0x0000000001211000-memory.dmp

        Filesize

        4KB

      • memory/2108-122-0x0000000000000000-mapping.dmp

      • memory/2384-115-0x0000000001170000-0x0000000001171000-memory.dmp

        Filesize

        4KB

      • memory/2384-116-0x0000000001171000-0x0000000001172000-memory.dmp

        Filesize

        4KB

      • memory/3044-117-0x0000000000000000-mapping.dmp