Analysis
-
max time kernel
125s -
max time network
123s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
24-10-2021 14:53
Static task
static1
Behavioral task
behavioral1
Sample
ORDERR-24102021.bat.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
ORDERR-24102021.bat.exe
Resource
win10-en-20211014
General
-
Target
ORDERR-24102021.bat.exe
-
Size
967KB
-
MD5
f4fa5d26ddfaeb8eb27ef6f1e83424a5
-
SHA1
9d2d7f411bcadfdf49300e370fa29617d482e026
-
SHA256
179d2c41bfd55de708d53b5c422df71f8a121aa67526edff75ba727e45db232f
-
SHA512
79336bc3047058258e77ad2858c39a57d15cf4a855eadd64f84e5e4a7eafac2c9f830688fbad80c7969776381b71ffa7895bc0f07d01f672980bfb7345e3d407
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.rambler.ru - Port:
587 - Username:
whore@rambler.ru - Password:
whore1
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/984-74-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/984-75-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/984-76-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/984-77-0x0000000000436D2E-mapping.dmp family_agenttesla behavioral1/memory/984-79-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Executes dropped EXE 2 IoCs
Processes:
rlDdJBs.exerlDdJBs.exepid process 952 rlDdJBs.exe 984 rlDdJBs.exe -
Loads dropped DLL 1 IoCs
Processes:
ORDERR-24102021.bat.exepid process 836 ORDERR-24102021.bat.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/836-57-0x00000000043E0000-0x0000000004401000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\rlDdJBs = "C:\\Users\\Admin\\AppData\\Roaming\\rlDdJBs.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rlDdJBs.exedescription pid process target process PID 952 set thread context of 984 952 rlDdJBs.exe rlDdJBs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
ORDERR-24102021.bat.exerlDdJBs.exerlDdJBs.exepid process 836 ORDERR-24102021.bat.exe 836 ORDERR-24102021.bat.exe 836 ORDERR-24102021.bat.exe 952 rlDdJBs.exe 952 rlDdJBs.exe 984 rlDdJBs.exe 984 rlDdJBs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ORDERR-24102021.bat.exerlDdJBs.exerlDdJBs.exedescription pid process Token: SeDebugPrivilege 836 ORDERR-24102021.bat.exe Token: SeDebugPrivilege 952 rlDdJBs.exe Token: SeDebugPrivilege 984 rlDdJBs.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
ORDERR-24102021.bat.execmd.exerlDdJBs.exedescription pid process target process PID 836 wrote to memory of 1828 836 ORDERR-24102021.bat.exe cmd.exe PID 836 wrote to memory of 1828 836 ORDERR-24102021.bat.exe cmd.exe PID 836 wrote to memory of 1828 836 ORDERR-24102021.bat.exe cmd.exe PID 836 wrote to memory of 1828 836 ORDERR-24102021.bat.exe cmd.exe PID 1828 wrote to memory of 668 1828 cmd.exe reg.exe PID 1828 wrote to memory of 668 1828 cmd.exe reg.exe PID 1828 wrote to memory of 668 1828 cmd.exe reg.exe PID 1828 wrote to memory of 668 1828 cmd.exe reg.exe PID 836 wrote to memory of 952 836 ORDERR-24102021.bat.exe rlDdJBs.exe PID 836 wrote to memory of 952 836 ORDERR-24102021.bat.exe rlDdJBs.exe PID 836 wrote to memory of 952 836 ORDERR-24102021.bat.exe rlDdJBs.exe PID 836 wrote to memory of 952 836 ORDERR-24102021.bat.exe rlDdJBs.exe PID 952 wrote to memory of 984 952 rlDdJBs.exe rlDdJBs.exe PID 952 wrote to memory of 984 952 rlDdJBs.exe rlDdJBs.exe PID 952 wrote to memory of 984 952 rlDdJBs.exe rlDdJBs.exe PID 952 wrote to memory of 984 952 rlDdJBs.exe rlDdJBs.exe PID 952 wrote to memory of 984 952 rlDdJBs.exe rlDdJBs.exe PID 952 wrote to memory of 984 952 rlDdJBs.exe rlDdJBs.exe PID 952 wrote to memory of 984 952 rlDdJBs.exe rlDdJBs.exe PID 952 wrote to memory of 984 952 rlDdJBs.exe rlDdJBs.exe PID 952 wrote to memory of 984 952 rlDdJBs.exe rlDdJBs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDERR-24102021.bat.exe"C:\Users\Admin\AppData\Local\Temp\ORDERR-24102021.bat.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "rlDdJBs" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\rlDdJBs.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "rlDdJBs" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\rlDdJBs.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\rlDdJBs.exe"C:\Users\Admin\AppData\Roaming\rlDdJBs.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\rlDdJBs.exe"C:\Users\Admin\AppData\Roaming\rlDdJBs.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\rlDdJBs.exeMD5
f4fa5d26ddfaeb8eb27ef6f1e83424a5
SHA19d2d7f411bcadfdf49300e370fa29617d482e026
SHA256179d2c41bfd55de708d53b5c422df71f8a121aa67526edff75ba727e45db232f
SHA51279336bc3047058258e77ad2858c39a57d15cf4a855eadd64f84e5e4a7eafac2c9f830688fbad80c7969776381b71ffa7895bc0f07d01f672980bfb7345e3d407
-
C:\Users\Admin\AppData\Roaming\rlDdJBs.exeMD5
f4fa5d26ddfaeb8eb27ef6f1e83424a5
SHA19d2d7f411bcadfdf49300e370fa29617d482e026
SHA256179d2c41bfd55de708d53b5c422df71f8a121aa67526edff75ba727e45db232f
SHA51279336bc3047058258e77ad2858c39a57d15cf4a855eadd64f84e5e4a7eafac2c9f830688fbad80c7969776381b71ffa7895bc0f07d01f672980bfb7345e3d407
-
C:\Users\Admin\AppData\Roaming\rlDdJBs.exeMD5
f4fa5d26ddfaeb8eb27ef6f1e83424a5
SHA19d2d7f411bcadfdf49300e370fa29617d482e026
SHA256179d2c41bfd55de708d53b5c422df71f8a121aa67526edff75ba727e45db232f
SHA51279336bc3047058258e77ad2858c39a57d15cf4a855eadd64f84e5e4a7eafac2c9f830688fbad80c7969776381b71ffa7895bc0f07d01f672980bfb7345e3d407
-
\Users\Admin\AppData\Roaming\rlDdJBs.exeMD5
f4fa5d26ddfaeb8eb27ef6f1e83424a5
SHA19d2d7f411bcadfdf49300e370fa29617d482e026
SHA256179d2c41bfd55de708d53b5c422df71f8a121aa67526edff75ba727e45db232f
SHA51279336bc3047058258e77ad2858c39a57d15cf4a855eadd64f84e5e4a7eafac2c9f830688fbad80c7969776381b71ffa7895bc0f07d01f672980bfb7345e3d407
-
memory/668-60-0x0000000000000000-mapping.dmp
-
memory/836-56-0x0000000004AA0000-0x0000000004AA1000-memory.dmpFilesize
4KB
-
memory/836-57-0x00000000043E0000-0x0000000004401000-memory.dmpFilesize
132KB
-
memory/836-58-0x0000000004AA1000-0x0000000004AA2000-memory.dmpFilesize
4KB
-
memory/836-54-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/952-69-0x0000000004E61000-0x0000000004E62000-memory.dmpFilesize
4KB
-
memory/952-65-0x0000000000FE0000-0x0000000000FE1000-memory.dmpFilesize
4KB
-
memory/952-67-0x0000000004E60000-0x0000000004E61000-memory.dmpFilesize
4KB
-
memory/952-62-0x0000000000000000-mapping.dmp
-
memory/952-70-0x0000000000B50000-0x0000000000B5B000-memory.dmpFilesize
44KB
-
memory/952-71-0x00000000006C0000-0x00000000006C1000-memory.dmpFilesize
4KB
-
memory/984-73-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/984-72-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/984-74-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/984-75-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/984-76-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/984-77-0x0000000000436D2E-mapping.dmp
-
memory/984-79-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/984-81-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/1828-59-0x0000000000000000-mapping.dmp