Analysis
-
max time kernel
161s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
08-02-2022 03:12
Static task
static1
Behavioral task
behavioral1
Sample
INV.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
INV.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral3
Sample
PACKING LISTS.exe
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
PACKING LISTS.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral5
Sample
PICS.exe
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
PICS.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral7
Sample
QUOTATION.exe
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
QUOTATION.exe
Resource
win10v2004-en-20220112
General
-
Target
INV.exe
-
Size
310KB
-
MD5
74af18caa94425fd150c9bc2b1b89771
-
SHA1
d324c1ea8218c2a65b89c47b0ba11b63acb464b0
-
SHA256
0689d5aa88eeabb27ebb29c4a50ce9d1d125e641484cc649ab1bf34327e611e5
-
SHA512
0d81e5216fd47ede4023996a82554e7592eb33c804a8d9407079482c5c0902d08cc4ae3cd3fb1ca019a1923c1213af594f63bd5f3b2aaa8ef46fc92dbe32d96d
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
[email protected] - Password:
MARYolanmauluogwo@ever
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3548-143-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Drops startup file 2 IoCs
Processes:
Powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe Powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe Powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
INV.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0rig40 = "C:\\Users\\Admin\\AppData\\Roaming\\0rig40\\0rig40.exe" INV.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
INV.exedescription pid process target process PID 3524 set thread context of 3548 3524 INV.exe INV.exe -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 45 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4112" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "6.547599" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132889550105715192" svchost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
INV.exePowershell.exeINV.exepid process 3524 INV.exe 3524 INV.exe 2252 Powershell.exe 3548 INV.exe 3548 INV.exe 2252 Powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
INV.exePowershell.exeINV.exedescription pid process Token: SeDebugPrivilege 3524 INV.exe Token: SeDebugPrivilege 2252 Powershell.exe Token: SeDebugPrivilege 3548 INV.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
INV.exedescription pid process target process PID 3524 wrote to memory of 2252 3524 INV.exe Powershell.exe PID 3524 wrote to memory of 2252 3524 INV.exe Powershell.exe PID 3524 wrote to memory of 2252 3524 INV.exe Powershell.exe PID 3524 wrote to memory of 3724 3524 INV.exe INV.exe PID 3524 wrote to memory of 3724 3524 INV.exe INV.exe PID 3524 wrote to memory of 3724 3524 INV.exe INV.exe PID 3524 wrote to memory of 3548 3524 INV.exe INV.exe PID 3524 wrote to memory of 3548 3524 INV.exe INV.exe PID 3524 wrote to memory of 3548 3524 INV.exe INV.exe PID 3524 wrote to memory of 3548 3524 INV.exe INV.exe PID 3524 wrote to memory of 3548 3524 INV.exe INV.exe PID 3524 wrote to memory of 3548 3524 INV.exe INV.exe PID 3524 wrote to memory of 3548 3524 INV.exe INV.exe PID 3524 wrote to memory of 3548 3524 INV.exe INV.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INV.exe"C:\Users\Admin\AppData\Local\Temp\INV.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\INV.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\INV.exe"C:\Users\Admin\AppData\Local\Temp\INV.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\INV.exe"C:\Users\Admin\AppData\Local\Temp\INV.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2252-147-0x00000000076A0000-0x0000000007706000-memory.dmpFilesize
408KB
-
memory/2252-148-0x0000000007840000-0x00000000078A6000-memory.dmpFilesize
408KB
-
memory/2252-142-0x0000000007000000-0x0000000007628000-memory.dmpFilesize
6.2MB
-
memory/2252-152-0x00000000082B0000-0x00000000082D2000-memory.dmpFilesize
136KB
-
memory/2252-151-0x0000000008310000-0x000000000832A000-memory.dmpFilesize
104KB
-
memory/2252-150-0x0000000008390000-0x0000000008426000-memory.dmpFilesize
600KB
-
memory/2252-138-0x00000000044F0000-0x0000000004526000-memory.dmpFilesize
216KB
-
memory/2252-140-0x00000000045B0000-0x00000000045B1000-memory.dmpFilesize
4KB
-
memory/2252-139-0x0000000074B90000-0x0000000075340000-memory.dmpFilesize
7.7MB
-
memory/2252-141-0x00000000045B2000-0x00000000045B3000-memory.dmpFilesize
4KB
-
memory/2252-149-0x0000000007E20000-0x0000000007E3E000-memory.dmpFilesize
120KB
-
memory/2252-146-0x0000000006EA0000-0x0000000006EC2000-memory.dmpFilesize
136KB
-
memory/3524-133-0x0000000005210000-0x00000000057B4000-memory.dmpFilesize
5.6MB
-
memory/3524-134-0x00000000053D0000-0x0000000005462000-memory.dmpFilesize
584KB
-
memory/3524-130-0x00000000008E0000-0x0000000000934000-memory.dmpFilesize
336KB
-
memory/3524-131-0x00000000057C0000-0x0000000005D64000-memory.dmpFilesize
5.6MB
-
memory/3524-132-0x0000000074B90000-0x0000000075340000-memory.dmpFilesize
7.7MB
-
memory/3524-135-0x0000000005470000-0x000000000550C000-memory.dmpFilesize
624KB
-
memory/3548-145-0x0000000005160000-0x0000000005704000-memory.dmpFilesize
5.6MB
-
memory/3548-143-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3548-144-0x0000000074B90000-0x0000000075340000-memory.dmpFilesize
7.7MB