Analysis
-
max time kernel
171s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
08-02-2022 02:06
Static task
static1
Behavioral task
behavioral1
Sample
Inv.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Inv.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral3
Sample
New Order.exe
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
New Order.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral5
Sample
Quotation.exe
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
Quotation.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral7
Sample
pictures and logo.exe
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
pictures and logo.exe
Resource
win10v2004-en-20220113
General
-
Target
Quotation.exe
-
Size
440KB
-
MD5
0547c6fd5e4d632b87d2f9a3dbc88587
-
SHA1
022d3a644567f960a1fa692ed576a4aaf5ca72a0
-
SHA256
e25588ef7f6dc061277b4380dc1f9ad034f1eb74c254cd778fea2ab7fe1783ab
-
SHA512
bed9caa917ff25a5168017952b401f4688f0f04c0075442bcb95d891017293b403c42a1e6f43cea4fc6ee5e2e80ae90d4c19afc293283eb4e840bc8871878129
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
[email protected] - Password:
MARYolanmauluogwo@ever
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral6/memory/320-145-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Drops startup file 2 IoCs
Processes:
Powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe Powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe Powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Quotation.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0rig40 = "C:\\Users\\Admin\\AppData\\Roaming\\0rig40\\0rig40.exe" Quotation.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Quotation.exedescription pid process target process PID 1208 set thread context of 320 1208 Quotation.exe Quotation.exe -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 45 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132889430759425225" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.824175" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4044" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Powershell.exeQuotation.exepid process 3980 Powershell.exe 320 Quotation.exe 320 Quotation.exe 3980 Powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Powershell.exeQuotation.exedescription pid process Token: SeDebugPrivilege 3980 Powershell.exe Token: SeDebugPrivilege 320 Quotation.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Quotation.exedescription pid process target process PID 1208 wrote to memory of 3980 1208 Quotation.exe Powershell.exe PID 1208 wrote to memory of 3980 1208 Quotation.exe Powershell.exe PID 1208 wrote to memory of 3980 1208 Quotation.exe Powershell.exe PID 1208 wrote to memory of 320 1208 Quotation.exe Quotation.exe PID 1208 wrote to memory of 320 1208 Quotation.exe Quotation.exe PID 1208 wrote to memory of 320 1208 Quotation.exe Quotation.exe PID 1208 wrote to memory of 320 1208 Quotation.exe Quotation.exe PID 1208 wrote to memory of 320 1208 Quotation.exe Quotation.exe PID 1208 wrote to memory of 320 1208 Quotation.exe Quotation.exe PID 1208 wrote to memory of 320 1208 Quotation.exe Quotation.exe PID 1208 wrote to memory of 320 1208 Quotation.exe Quotation.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\Quotation.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quotation.exe.logMD5
553cfcb8247e9e828eef0474e2134fac
SHA1362c3f93dccc66f3bbfaf5ef681a11a0c7bc7316
SHA256a753cbd5f89b034eaeeb02fa8f0924bab30e84d86d02686fdf7c0228d8a00d54
SHA51218b4174286f47b41f47e964c5368b453eba4a23331958e7b982017f965a434aa80c0d3504d13521a9f0550bba4c2b7a62543553d4ddfdf6e1f0c39c6ef542dc4
-
memory/320-150-0x0000000004D90000-0x0000000005334000-memory.dmpFilesize
5.6MB
-
memory/320-149-0x0000000074500000-0x0000000074CB0000-memory.dmpFilesize
7.7MB
-
memory/320-145-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1208-131-0x0000000000600000-0x0000000000674000-memory.dmpFilesize
464KB
-
memory/1208-132-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/1208-133-0x0000000005680000-0x0000000005B4C000-memory.dmpFilesize
4.8MB
-
memory/1208-134-0x0000000005290000-0x0000000005322000-memory.dmpFilesize
584KB
-
memory/1208-135-0x0000000006100000-0x00000000066A4000-memory.dmpFilesize
5.6MB
-
memory/1208-136-0x00000000054B0000-0x000000000554C000-memory.dmpFilesize
624KB
-
memory/1208-130-0x0000000074500000-0x0000000074CB0000-memory.dmpFilesize
7.7MB
-
memory/3980-143-0x0000000007110000-0x0000000007150000-memory.dmpFilesize
256KB
-
memory/3980-144-0x0000000007780000-0x00000000077A2000-memory.dmpFilesize
136KB
-
memory/3980-146-0x0000000008060000-0x00000000080C6000-memory.dmpFilesize
408KB
-
memory/3980-142-0x0000000007110000-0x0000000007150000-memory.dmpFilesize
256KB
-
memory/3980-147-0x00000000080D0000-0x0000000008136000-memory.dmpFilesize
408KB
-
memory/3980-141-0x0000000074500000-0x0000000074CB0000-memory.dmpFilesize
7.7MB
-
memory/3980-140-0x0000000007800000-0x0000000007E28000-memory.dmpFilesize
6.2MB
-
memory/3980-139-0x0000000007190000-0x00000000071C6000-memory.dmpFilesize
216KB
-
memory/3980-151-0x0000000008760000-0x000000000877E000-memory.dmpFilesize
120KB
-
memory/3980-152-0x0000000008CD0000-0x0000000008D66000-memory.dmpFilesize
600KB
-
memory/3980-153-0x0000000008C50000-0x0000000008C6A000-memory.dmpFilesize
104KB
-
memory/3980-154-0x0000000008CA0000-0x0000000008CC2000-memory.dmpFilesize
136KB