Analysis
-
max time kernel
118s -
max time network
136s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
08-02-2022 03:12
Static task
static1
Behavioral task
behavioral1
Sample
INV.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
INV.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral3
Sample
PACKING LISTS.exe
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
PACKING LISTS.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral5
Sample
PICS.exe
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
PICS.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral7
Sample
QUOTATION.exe
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
QUOTATION.exe
Resource
win10v2004-en-20220112
General
-
Target
PACKING LISTS.exe
-
Size
309KB
-
MD5
25e396015a9db6326384b2091bcc9fad
-
SHA1
e7b083cb514c5d6625b6babfffe7429537aeca4f
-
SHA256
15b7e016d58fd18d0f7eb8f578ba217b9aaac7367c0eddd7a545f9d98d49e288
-
SHA512
23d1b45f1324c5206a1a05f11046d56bbeefa996953d0697c06f3ceb6f59a9d67b150e2742661b828d2c1218153f45cd8a6bbf3f59b0b8309d2ad03734119b05
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
[email protected] - Password:
MARYolanmauluogwo@ever
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral3/memory/456-64-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral3/memory/456-65-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral3/memory/456-66-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral3/memory/456-70-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Drops startup file 2 IoCs
Processes:
Powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe Powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe Powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\0rig20 = "C:\\Users\\Admin\\AppData\\Roaming\\0rig20\\0rig20.exe" RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PACKING LISTS.exedescription pid process target process PID 1648 set thread context of 456 1648 PACKING LISTS.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
RegAsm.exePowershell.exepid process 456 RegAsm.exe 456 RegAsm.exe 472 Powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegAsm.exePowershell.exedescription pid process Token: SeDebugPrivilege 456 RegAsm.exe Token: SeDebugPrivilege 472 Powershell.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
PACKING LISTS.exedescription pid process target process PID 1648 wrote to memory of 472 1648 PACKING LISTS.exe Powershell.exe PID 1648 wrote to memory of 472 1648 PACKING LISTS.exe Powershell.exe PID 1648 wrote to memory of 472 1648 PACKING LISTS.exe Powershell.exe PID 1648 wrote to memory of 472 1648 PACKING LISTS.exe Powershell.exe PID 1648 wrote to memory of 456 1648 PACKING LISTS.exe RegAsm.exe PID 1648 wrote to memory of 456 1648 PACKING LISTS.exe RegAsm.exe PID 1648 wrote to memory of 456 1648 PACKING LISTS.exe RegAsm.exe PID 1648 wrote to memory of 456 1648 PACKING LISTS.exe RegAsm.exe PID 1648 wrote to memory of 456 1648 PACKING LISTS.exe RegAsm.exe PID 1648 wrote to memory of 456 1648 PACKING LISTS.exe RegAsm.exe PID 1648 wrote to memory of 456 1648 PACKING LISTS.exe RegAsm.exe PID 1648 wrote to memory of 456 1648 PACKING LISTS.exe RegAsm.exe PID 1648 wrote to memory of 456 1648 PACKING LISTS.exe RegAsm.exe PID 1648 wrote to memory of 456 1648 PACKING LISTS.exe RegAsm.exe PID 1648 wrote to memory of 456 1648 PACKING LISTS.exe RegAsm.exe PID 1648 wrote to memory of 456 1648 PACKING LISTS.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PACKING LISTS.exe"C:\Users\Admin\AppData\Local\Temp\PACKING LISTS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\PACKING LISTS.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/456-71-0x0000000074180000-0x000000007486E000-memory.dmpFilesize
6.9MB
-
memory/456-70-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/456-65-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/456-66-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/456-64-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/456-62-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/456-63-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/456-72-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/472-75-0x0000000002420000-0x000000000306A000-memory.dmpFilesize
12.3MB
-
memory/472-74-0x0000000002420000-0x000000000306A000-memory.dmpFilesize
12.3MB
-
memory/472-73-0x000000006F5D0000-0x000000006FB7B000-memory.dmpFilesize
5.7MB
-
memory/1648-61-0x0000000000480000-0x0000000000496000-memory.dmpFilesize
88KB
-
memory/1648-55-0x0000000074180000-0x000000007486E000-memory.dmpFilesize
6.9MB
-
memory/1648-58-0x0000000004B10000-0x0000000004B11000-memory.dmpFilesize
4KB
-
memory/1648-57-0x0000000075021000-0x0000000075023000-memory.dmpFilesize
8KB
-
memory/1648-76-0x0000000004B15000-0x0000000004B26000-memory.dmpFilesize
68KB
-
memory/1648-56-0x0000000000950000-0x00000000009A4000-memory.dmpFilesize
336KB
-
memory/1648-59-0x00000000001D0000-0x0000000000220000-memory.dmpFilesize
320KB