Analysis
-
max time kernel
129s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
18-10-2021 18:30
Static task
static1
Behavioral task
behavioral1
Sample
BND28384.exe
Resource
win7-en-20211014
General
-
Target
BND28384.exe
-
Size
739KB
-
MD5
91b12e9726457f2c6ad29b8b27bf7e3c
-
SHA1
03406222c3cc95e03736a5844e31975b714758dd
-
SHA256
e4a297a62797d50a37f87d75499be34639395d4791416d2be66c0e3c6a43a8d1
-
SHA512
8e220ae8c5765fcb4cb65e5d04f4f7c296ecd22d6d81556bc4cf908b66e49210e8139e18b9a82f837870c390388d10f9cea2a575d46b6dc8dc574585500cb907
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.westviewcargos.com - Port:
587 - Username:
[email protected] - Password:
Choice@@@12345
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/940-119-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/940-120-0x00000000004377EE-mapping.dmp family_agenttesla -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
BND28384.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion BND28384.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion BND28384.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
BND28384.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum BND28384.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 BND28384.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BND28384.exedescription pid process target process PID 2384 set thread context of 940 2384 BND28384.exe BND28384.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
BND28384.exedw20.exepid process 2384 BND28384.exe 2384 BND28384.exe 2384 BND28384.exe 2384 BND28384.exe 2384 BND28384.exe 2108 dw20.exe 2108 dw20.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
BND28384.exedw20.exedescription pid process Token: SeDebugPrivilege 2384 BND28384.exe Token: SeRestorePrivilege 2108 dw20.exe Token: SeBackupPrivilege 2108 dw20.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
BND28384.exeBND28384.exedescription pid process target process PID 2384 wrote to memory of 3044 2384 BND28384.exe schtasks.exe PID 2384 wrote to memory of 3044 2384 BND28384.exe schtasks.exe PID 2384 wrote to memory of 3044 2384 BND28384.exe schtasks.exe PID 2384 wrote to memory of 928 2384 BND28384.exe BND28384.exe PID 2384 wrote to memory of 928 2384 BND28384.exe BND28384.exe PID 2384 wrote to memory of 928 2384 BND28384.exe BND28384.exe PID 2384 wrote to memory of 2316 2384 BND28384.exe BND28384.exe PID 2384 wrote to memory of 2316 2384 BND28384.exe BND28384.exe PID 2384 wrote to memory of 2316 2384 BND28384.exe BND28384.exe PID 2384 wrote to memory of 940 2384 BND28384.exe BND28384.exe PID 2384 wrote to memory of 940 2384 BND28384.exe BND28384.exe PID 2384 wrote to memory of 940 2384 BND28384.exe BND28384.exe PID 2384 wrote to memory of 940 2384 BND28384.exe BND28384.exe PID 2384 wrote to memory of 940 2384 BND28384.exe BND28384.exe PID 2384 wrote to memory of 940 2384 BND28384.exe BND28384.exe PID 2384 wrote to memory of 940 2384 BND28384.exe BND28384.exe PID 2384 wrote to memory of 940 2384 BND28384.exe BND28384.exe PID 940 wrote to memory of 2108 940 BND28384.exe dw20.exe PID 940 wrote to memory of 2108 940 BND28384.exe dw20.exe PID 940 wrote to memory of 2108 940 BND28384.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BND28384.exe"C:\Users\Admin\AppData\Local\Temp\BND28384.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vwXKdwSIXtu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDA3F.tmp"2⤵
- Creates scheduled task(s)
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\BND28384.exe"{path}"2⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\BND28384.exe"{path}"2⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\BND28384.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7043⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2108
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
04ed5246c6fe2244d2885e6654fa8361
SHA18d780ce3bba85141f9e2158c165b52487dd5823a
SHA256ca114a622a02924b818488b080834d1b1367607fc29ab3105302b81457398ab5
SHA51248698b1601477f3e50fde16f26f4b99246de7231e2d735f95f8974f3efded92436a47558d3bd5ea7e928e64b90ceaeaf0ab904c27ef5e83b7b7e6300be4b3d41
-
MD5
d9fb81c91ff85ec11a8536bbb5c043a0
SHA13baa0ac7cd26929ca80061fc4d5e41675218b4ae
SHA256184b9433065166b387a6cb2aae16b48e5460f4e9c6aaec2caf4ec6db682287f3
SHA512746b9020314cfbb95d5dac27e46b000dc43879e7bb4d9ceda7c402c7ef9ba24fb0d63efa6277300b193c8076370605586832a21382950ac10ce39b7bdf6a15df