Analysis
-
max time kernel
128s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
24-10-2021 14:53
Static task
static1
Behavioral task
behavioral1
Sample
ORDERR-24102021.bat.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
ORDERR-24102021.bat.exe
Resource
win10-en-20211014
General
-
Target
ORDERR-24102021.bat.exe
-
Size
967KB
-
MD5
f4fa5d26ddfaeb8eb27ef6f1e83424a5
-
SHA1
9d2d7f411bcadfdf49300e370fa29617d482e026
-
SHA256
179d2c41bfd55de708d53b5c422df71f8a121aa67526edff75ba727e45db232f
-
SHA512
79336bc3047058258e77ad2858c39a57d15cf4a855eadd64f84e5e4a7eafac2c9f830688fbad80c7969776381b71ffa7895bc0f07d01f672980bfb7345e3d407
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.rambler.ru - Port:
587 - Username:
whore@rambler.ru - Password:
whore1
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/372-144-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/372-145-0x0000000000436D2E-mapping.dmp family_agenttesla behavioral2/memory/372-152-0x0000000005290000-0x000000000578E000-memory.dmp family_agenttesla -
Executes dropped EXE 2 IoCs
Processes:
rlDdJBs.exerlDdJBs.exepid process 2876 rlDdJBs.exe 372 rlDdJBs.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/3576-122-0x0000000006A00000-0x0000000006A21000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\rlDdJBs = "C:\\Users\\Admin\\AppData\\Roaming\\rlDdJBs.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rlDdJBs.exedescription pid process target process PID 2876 set thread context of 372 2876 rlDdJBs.exe rlDdJBs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
ORDERR-24102021.bat.exerlDdJBs.exerlDdJBs.exepid process 3576 ORDERR-24102021.bat.exe 3576 ORDERR-24102021.bat.exe 3576 ORDERR-24102021.bat.exe 3576 ORDERR-24102021.bat.exe 3576 ORDERR-24102021.bat.exe 3576 ORDERR-24102021.bat.exe 3576 ORDERR-24102021.bat.exe 3576 ORDERR-24102021.bat.exe 3576 ORDERR-24102021.bat.exe 3576 ORDERR-24102021.bat.exe 3576 ORDERR-24102021.bat.exe 3576 ORDERR-24102021.bat.exe 3576 ORDERR-24102021.bat.exe 3576 ORDERR-24102021.bat.exe 3576 ORDERR-24102021.bat.exe 2876 rlDdJBs.exe 2876 rlDdJBs.exe 372 rlDdJBs.exe 372 rlDdJBs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ORDERR-24102021.bat.exerlDdJBs.exerlDdJBs.exedescription pid process Token: SeDebugPrivilege 3576 ORDERR-24102021.bat.exe Token: SeDebugPrivilege 2876 rlDdJBs.exe Token: SeDebugPrivilege 372 rlDdJBs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
ORDERR-24102021.bat.execmd.exerlDdJBs.exedescription pid process target process PID 3576 wrote to memory of 1052 3576 ORDERR-24102021.bat.exe cmd.exe PID 3576 wrote to memory of 1052 3576 ORDERR-24102021.bat.exe cmd.exe PID 3576 wrote to memory of 1052 3576 ORDERR-24102021.bat.exe cmd.exe PID 1052 wrote to memory of 2256 1052 cmd.exe reg.exe PID 1052 wrote to memory of 2256 1052 cmd.exe reg.exe PID 1052 wrote to memory of 2256 1052 cmd.exe reg.exe PID 3576 wrote to memory of 2876 3576 ORDERR-24102021.bat.exe rlDdJBs.exe PID 3576 wrote to memory of 2876 3576 ORDERR-24102021.bat.exe rlDdJBs.exe PID 3576 wrote to memory of 2876 3576 ORDERR-24102021.bat.exe rlDdJBs.exe PID 2876 wrote to memory of 372 2876 rlDdJBs.exe rlDdJBs.exe PID 2876 wrote to memory of 372 2876 rlDdJBs.exe rlDdJBs.exe PID 2876 wrote to memory of 372 2876 rlDdJBs.exe rlDdJBs.exe PID 2876 wrote to memory of 372 2876 rlDdJBs.exe rlDdJBs.exe PID 2876 wrote to memory of 372 2876 rlDdJBs.exe rlDdJBs.exe PID 2876 wrote to memory of 372 2876 rlDdJBs.exe rlDdJBs.exe PID 2876 wrote to memory of 372 2876 rlDdJBs.exe rlDdJBs.exe PID 2876 wrote to memory of 372 2876 rlDdJBs.exe rlDdJBs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDERR-24102021.bat.exe"C:\Users\Admin\AppData\Local\Temp\ORDERR-24102021.bat.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "rlDdJBs" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\rlDdJBs.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "rlDdJBs" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\rlDdJBs.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\rlDdJBs.exe"C:\Users\Admin\AppData\Roaming\rlDdJBs.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\rlDdJBs.exe"C:\Users\Admin\AppData\Roaming\rlDdJBs.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rlDdJBs.exe.logMD5
4951adb59b50f2061ffc91a0466fcd5a
SHA1ea1420b0f4ea4ba7a5112937d5b846586fe56965
SHA2564778c7e2fc1de6559660fd796fb9a843b9149d31f7806d3e692fe69bdfcb163e
SHA51297828dff6e48ef344259d61945427aa25228f5b9c80b978a7b22768453278e0f54962fee78942645423776e10b44551f85600df724f4f9ba4415cbd69766ebb6
-
C:\Users\Admin\AppData\Roaming\rlDdJBs.exeMD5
f4fa5d26ddfaeb8eb27ef6f1e83424a5
SHA19d2d7f411bcadfdf49300e370fa29617d482e026
SHA256179d2c41bfd55de708d53b5c422df71f8a121aa67526edff75ba727e45db232f
SHA51279336bc3047058258e77ad2858c39a57d15cf4a855eadd64f84e5e4a7eafac2c9f830688fbad80c7969776381b71ffa7895bc0f07d01f672980bfb7345e3d407
-
C:\Users\Admin\AppData\Roaming\rlDdJBs.exeMD5
f4fa5d26ddfaeb8eb27ef6f1e83424a5
SHA19d2d7f411bcadfdf49300e370fa29617d482e026
SHA256179d2c41bfd55de708d53b5c422df71f8a121aa67526edff75ba727e45db232f
SHA51279336bc3047058258e77ad2858c39a57d15cf4a855eadd64f84e5e4a7eafac2c9f830688fbad80c7969776381b71ffa7895bc0f07d01f672980bfb7345e3d407
-
C:\Users\Admin\AppData\Roaming\rlDdJBs.exeMD5
f4fa5d26ddfaeb8eb27ef6f1e83424a5
SHA19d2d7f411bcadfdf49300e370fa29617d482e026
SHA256179d2c41bfd55de708d53b5c422df71f8a121aa67526edff75ba727e45db232f
SHA51279336bc3047058258e77ad2858c39a57d15cf4a855eadd64f84e5e4a7eafac2c9f830688fbad80c7969776381b71ffa7895bc0f07d01f672980bfb7345e3d407
-
memory/372-153-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/372-152-0x0000000005290000-0x000000000578E000-memory.dmpFilesize
5.0MB
-
memory/372-145-0x0000000000436D2E-mapping.dmp
-
memory/372-144-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1052-125-0x0000000000000000-mapping.dmp
-
memory/2256-126-0x0000000000000000-mapping.dmp
-
memory/2876-143-0x0000000006930000-0x0000000006931000-memory.dmpFilesize
4KB
-
memory/2876-141-0x0000000005C31000-0x0000000005C32000-memory.dmpFilesize
4KB
-
memory/2876-128-0x0000000000000000-mapping.dmp
-
memory/2876-142-0x00000000068D0000-0x00000000068DB000-memory.dmpFilesize
44KB
-
memory/2876-140-0x0000000005C30000-0x0000000005C31000-memory.dmpFilesize
4KB
-
memory/3576-123-0x0000000006B10000-0x0000000006B11000-memory.dmpFilesize
4KB
-
memory/3576-127-0x0000000005D51000-0x0000000005D52000-memory.dmpFilesize
4KB
-
memory/3576-124-0x0000000006AE0000-0x0000000006AE1000-memory.dmpFilesize
4KB
-
memory/3576-115-0x00000000007D0000-0x00000000007D1000-memory.dmpFilesize
4KB
-
memory/3576-122-0x0000000006A00000-0x0000000006A21000-memory.dmpFilesize
132KB
-
memory/3576-121-0x0000000005D50000-0x0000000005D51000-memory.dmpFilesize
4KB
-
memory/3576-120-0x0000000005C60000-0x0000000005C61000-memory.dmpFilesize
4KB
-
memory/3576-119-0x0000000005300000-0x0000000005301000-memory.dmpFilesize
4KB
-
memory/3576-118-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/3576-117-0x00000000056C0000-0x00000000056C1000-memory.dmpFilesize
4KB