Analysis
- max time kernel
129s - max time network
121s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
30/01/2022, 14:18
General
- Target Draft Quotation 20220130.exe
- Size 483KB
- Sample220130-rmaj9acccj
- SHA256 7ef2a4ddbdb6f28ec39e26bbd6883221326eaf51babfca78fdb27f1d5f4fdbe1
Malware Config
Extracted
-
agenttesla
-
https://api.telegram.org/bot2030557675:AAF2CRvHF_rfT7tYXz9VN8YUb6kF5qxu_xg/sendDocument
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- Looks for VMWare Tools registry key 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Draft Quotation 20220130.exe"C:\Users\Admin\AppData\Local\Temp\Draft Quotation 20220130.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Draft Quotation 20220130.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UJXlESjG.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UJXlESjG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBAA1.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Draft Quotation 20220130.exe"C:\Users\Admin\AppData\Local\Temp\Draft Quotation 20220130.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Draft Quotation 20220130.exe"C:\Users\Admin\AppData\Local\Temp\Draft Quotation 20220130.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Draft Quotation 20220130.exe"C:\Users\Admin\AppData\Local\Temp\Draft Quotation 20220130.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/424-176-0x000000007F690000-0x000000007F691000-memory.dmp
memory/424-178-0x0000000001263000-0x0000000001264000-memory.dmp
memory/424-139-0x0000000001262000-0x0000000001263000-memory.dmp
memory/424-163-0x0000000009620000-0x0000000009653000-memory.dmp
memory/424-146-0x00000000085A0000-0x0000000008616000-memory.dmp
memory/424-145-0x00000000082E0000-0x000000000832B000-memory.dmp
memory/424-144-0x00000000074F0000-0x000000000750C000-memory.dmp
memory/424-179-0x0000000009950000-0x00000000099E4000-memory.dmp
memory/424-573-0x0000000009830000-0x0000000009838000-memory.dmp
memory/424-138-0x0000000001260000-0x0000000001261000-memory.dmp
memory/2068-173-0x0000000005950000-0x0000000005968000-memory.dmp
memory/2068-141-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2068-143-0x0000000005470000-0x000000000596E000-memory.dmp
memory/3384-175-0x000000007E290000-0x000000007E291000-memory.dmp
memory/3384-174-0x0000000009A40000-0x0000000009AE5000-memory.dmp
memory/3384-133-0x0000000007990000-0x00000000079B2000-memory.dmp
memory/3384-130-0x0000000007610000-0x0000000007611000-memory.dmp
memory/3384-134-0x0000000007A30000-0x0000000007A96000-memory.dmp
memory/3384-131-0x0000000007612000-0x0000000007613000-memory.dmp
memory/3384-129-0x0000000004F90000-0x0000000004FC6000-memory.dmp
memory/3384-564-0x0000000009D30000-0x0000000009D4A000-memory.dmp
memory/3384-177-0x0000000007613000-0x0000000007614000-memory.dmp
memory/3384-164-0x0000000009680000-0x000000000969E000-memory.dmp
memory/3384-135-0x0000000008380000-0x00000000086D0000-memory.dmp
memory/3384-132-0x0000000007C50000-0x0000000008278000-memory.dmp
memory/3760-124-0x0000000007B30000-0x0000000007BCC000-memory.dmp
memory/3760-118-0x0000000000A60000-0x0000000000AE0000-memory.dmp
memory/3760-125-0x0000000007DF0000-0x0000000007E60000-memory.dmp
memory/3760-123-0x0000000005830000-0x000000000583C000-memory.dmp
memory/3760-122-0x0000000005340000-0x000000000583E000-memory.dmp
memory/3760-126-0x00000000081E0000-0x0000000008246000-memory.dmp
memory/3760-121-0x0000000005310000-0x000000000531A000-memory.dmp
memory/3760-120-0x00000000053E0000-0x0000000005472000-memory.dmp
memory/3760-119-0x0000000005840000-0x0000000005D3E000-memory.dmp