Analysis
-
max time kernel
154s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 22:57
Static task
static1
Behavioral task
behavioral1
Sample
purchase order from Innovix Distribution Limited, Hong Kong.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
purchase order from Innovix Distribution Limited, Hong Kong.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
tender document.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
tender document.exe
Resource
win10v2004-20220414-en
General
-
Target
tender document.exe
-
Size
418KB
-
MD5
aa66f3dc29dda2018492a5075dbf782c
-
SHA1
18d7bd5e15ca54bf73ebfa586b3f4fae79cc09f2
-
SHA256
985f9b81daf2acb7ea196c9a7de019064ed08ce19614ad1de0d3e350fbec2dd9
-
SHA512
39b09bd610a32cfedde6382da29d164189de9aa1edd87ed0a195e872deda495d04fbf0cc5bcc27b94adc7b34308d23a37c7d3ad4dedd1839adcbe2dbb48c47c8
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.ontime.com.ph - Port:
587 - Username:
[email protected] - Password:
OTelvie1234
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral4/memory/4392-134-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tender document.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation tender document.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
tender document.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 tender document.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 tender document.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 tender document.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tender document.exedescription pid process target process PID 2820 set thread context of 4392 2820 tender document.exe tender document.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
tender document.exepid process 4392 tender document.exe 4392 tender document.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
tender document.exedescription pid process Token: SeDebugPrivilege 4392 tender document.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
tender document.exedescription pid process target process PID 2820 wrote to memory of 792 2820 tender document.exe schtasks.exe PID 2820 wrote to memory of 792 2820 tender document.exe schtasks.exe PID 2820 wrote to memory of 792 2820 tender document.exe schtasks.exe PID 2820 wrote to memory of 4392 2820 tender document.exe tender document.exe PID 2820 wrote to memory of 4392 2820 tender document.exe tender document.exe PID 2820 wrote to memory of 4392 2820 tender document.exe tender document.exe PID 2820 wrote to memory of 4392 2820 tender document.exe tender document.exe PID 2820 wrote to memory of 4392 2820 tender document.exe tender document.exe PID 2820 wrote to memory of 4392 2820 tender document.exe tender document.exe PID 2820 wrote to memory of 4392 2820 tender document.exe tender document.exe PID 2820 wrote to memory of 4392 2820 tender document.exe tender document.exe -
outlook_office_path 1 IoCs
Processes:
tender document.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 tender document.exe -
outlook_win_path 1 IoCs
Processes:
tender document.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 tender document.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tender document.exe"C:\Users\Admin\AppData\Local\Temp\tender document.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eUDSrXeZta" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3354.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\tender document.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\tender document.exe.logFilesize
408B
MD58adbb2cb7759fdcbc51cfbf0bfd7c867
SHA1f7549e6ea430e7d64b3afb3fc27c77ed5122f85b
SHA256c67092561e4b1472672374c3439004e2bc0191d9a901cde2b8b69a2d34dc6297
SHA512f465311e884dd82e3152959b6a59ac8d6be0a056a1cfddabbcc6714079a2269cd5c09b2b8fbc87a9ec3323c531383526ae19ef24fed100dec80730fae0d79991
-
C:\Users\Admin\AppData\Local\Temp\tmp3354.tmpFilesize
1KB
MD55e5592fc2665497fd72a0545b4ccc605
SHA1cbfe3e5037bcafe2a3602a87ea072e801b9fb9c3
SHA2562a9ccda418b6cd56e4e1dc4752fb2a085ada89916618486d0752278b7cb7c0f0
SHA512b8d3acdc4b3ceffc932c10fa202ddb29ff7e713f8e42580b18ec0e2587a5b409e73c6b48eb5da8d6ff56d8a94d40c7956c4652d881c7a611f41255b74c80e79e
-
memory/792-131-0x0000000000000000-mapping.dmp
-
memory/2820-130-0x0000000075520000-0x0000000075AD1000-memory.dmpFilesize
5.7MB
-
memory/4392-133-0x0000000000000000-mapping.dmp
-
memory/4392-134-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/4392-136-0x0000000075520000-0x0000000075AD1000-memory.dmpFilesize
5.7MB