Analysis

  • max time kernel
    103s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    15-04-2022 08:48

General

  • Target

    c5918508f1e4174bf84c1553187cf08bac22d7358b91ab2bf39b8dda27a98154.exe

  • Size

    650KB

  • MD5

    0846e2ec8c618ce82d0b5afe3d1d4bdc

  • SHA1

    f62b82177f25af6d0dabd0bd8c2820270651ca79

  • SHA256

    c5918508f1e4174bf84c1553187cf08bac22d7358b91ab2bf39b8dda27a98154

  • SHA512

    1b53b80a2a6fbf582e8ba6ee22a6b4b5900dae3143adf4ccc47ffb41ff75af0fb46eaef58ad6836c0844f39b923d92e0d549db8fc5f83f198a7c29034606a163

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.theislandshipping.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ship666

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload 6 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs
  • Looks for VMWare Tools registry key 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c5918508f1e4174bf84c1553187cf08bac22d7358b91ab2bf39b8dda27a98154.exe
    "C:\Users\Admin\AppData\Local\Temp\c5918508f1e4174bf84c1553187cf08bac22d7358b91ab2bf39b8dda27a98154.exe"
    1⤵
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\staqGDhotB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF8A2.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1312
    • C:\Users\Admin\AppData\Local\Temp\c5918508f1e4174bf84c1553187cf08bac22d7358b91ab2bf39b8dda27a98154.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1220

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpF8A2.tmp

    Filesize

    1KB

    MD5

    e1e3ca53efca2635957df3dd30b84b2b

    SHA1

    9d6b2d6556367b1663b383099067d03e991943ea

    SHA256

    5f74db713c1c301669608cdef0da5ab11f03bd907240cf1a4a500c22afe5ee7c

    SHA512

    1cf0ab7c52fcfff512332eefc1b45b6774330aa92bb3022aa20ee2550816ecf6110e432145c625f8f796c2e122fbf2f98f7a00072af6b90b5587e1a148cbb8e7

  • memory/1220-59-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1220-62-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1220-63-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1220-60-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1220-64-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1220-67-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1220-69-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1948-56-0x00000000048D0000-0x0000000004936000-memory.dmp

    Filesize

    408KB

  • memory/1948-55-0x0000000000AF0000-0x0000000000B0C000-memory.dmp

    Filesize

    112KB

  • memory/1948-54-0x0000000000B10000-0x0000000000BB8000-memory.dmp

    Filesize

    672KB