Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:24
Static task
static1
Behavioral task
behavioral1
Sample
Qatar Order.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Qatar Order.exe
Resource
win10v2004-20220414-en
General
-
Target
Qatar Order.exe
-
Size
952KB
-
MD5
35886dda90c82b5777f9173b5d0182ff
-
SHA1
9a6db6e787d57f5f29ac88bea46377f9b19f7d3d
-
SHA256
f9d23884ea2c8b181615c7e0eaeee633d85d5c7c76ed347ce02fb89c5529ebe7
-
SHA512
053512ab2f50c2c5639a969abab077a56aaa7c9f77f6710a2ce503d5a21ea6c6a706cb1f698ec092c9afd511c8189fbb5e7eaf59de668d4fa6d55890c93f62ba
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
Remember@123#
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1156-64-0x0000000000400000-0x0000000000458000-memory.dmp family_agenttesla behavioral1/memory/1156-65-0x0000000000400000-0x0000000000458000-memory.dmp family_agenttesla behavioral1/memory/1156-66-0x0000000000400000-0x0000000000458000-memory.dmp family_agenttesla behavioral1/memory/1156-67-0x0000000000453DAE-mapping.dmp family_agenttesla behavioral1/memory/1156-69-0x0000000000400000-0x0000000000458000-memory.dmp family_agenttesla behavioral1/memory/1156-71-0x0000000000400000-0x0000000000458000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Qatar Order.exedescription pid process target process PID 1364 set thread context of 1156 1364 Qatar Order.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Qatar Order.exeRegSvcs.exepid process 1364 Qatar Order.exe 1364 Qatar Order.exe 1364 Qatar Order.exe 1364 Qatar Order.exe 1156 RegSvcs.exe 1156 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Qatar Order.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1364 Qatar Order.exe Token: SeDebugPrivilege 1156 RegSvcs.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
Qatar Order.exedescription pid process target process PID 1364 wrote to memory of 364 1364 Qatar Order.exe schtasks.exe PID 1364 wrote to memory of 364 1364 Qatar Order.exe schtasks.exe PID 1364 wrote to memory of 364 1364 Qatar Order.exe schtasks.exe PID 1364 wrote to memory of 364 1364 Qatar Order.exe schtasks.exe PID 1364 wrote to memory of 1104 1364 Qatar Order.exe RegSvcs.exe PID 1364 wrote to memory of 1104 1364 Qatar Order.exe RegSvcs.exe PID 1364 wrote to memory of 1104 1364 Qatar Order.exe RegSvcs.exe PID 1364 wrote to memory of 1104 1364 Qatar Order.exe RegSvcs.exe PID 1364 wrote to memory of 1104 1364 Qatar Order.exe RegSvcs.exe PID 1364 wrote to memory of 1104 1364 Qatar Order.exe RegSvcs.exe PID 1364 wrote to memory of 1104 1364 Qatar Order.exe RegSvcs.exe PID 1364 wrote to memory of 1156 1364 Qatar Order.exe RegSvcs.exe PID 1364 wrote to memory of 1156 1364 Qatar Order.exe RegSvcs.exe PID 1364 wrote to memory of 1156 1364 Qatar Order.exe RegSvcs.exe PID 1364 wrote to memory of 1156 1364 Qatar Order.exe RegSvcs.exe PID 1364 wrote to memory of 1156 1364 Qatar Order.exe RegSvcs.exe PID 1364 wrote to memory of 1156 1364 Qatar Order.exe RegSvcs.exe PID 1364 wrote to memory of 1156 1364 Qatar Order.exe RegSvcs.exe PID 1364 wrote to memory of 1156 1364 Qatar Order.exe RegSvcs.exe PID 1364 wrote to memory of 1156 1364 Qatar Order.exe RegSvcs.exe PID 1364 wrote to memory of 1156 1364 Qatar Order.exe RegSvcs.exe PID 1364 wrote to memory of 1156 1364 Qatar Order.exe RegSvcs.exe PID 1364 wrote to memory of 1156 1364 Qatar Order.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Qatar Order.exe"C:\Users\Admin\AppData\Local\Temp\Qatar Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zEhvEKA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8F7.tmp"2⤵
- Creates scheduled task(s)
PID:364 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵PID:1104
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1156
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8F7.tmpFilesize
1KB
MD5cb784328b42969f11bafaedca646c635
SHA1cc85078f09a5d26b9baaee5020f785fcd01e6dcb
SHA256978f76c6c613098029650d9c48c2ccbaa42a294e3299318a39b24e49b0556ec5
SHA5128fd2534cd018db7b0cc117f494160c72a686152fc005fa7cf50348267acc3d2b03f889cb01241fafdada558e745d6294fbb66ee7674f558efeaed55439c95ddc
-
memory/364-59-0x0000000000000000-mapping.dmp
-
memory/1156-64-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1156-61-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1156-62-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1156-65-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1156-66-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1156-67-0x0000000000453DAE-mapping.dmp
-
memory/1156-69-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1156-71-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1364-57-0x0000000004FE0000-0x0000000005052000-memory.dmpFilesize
456KB
-
memory/1364-58-0x0000000005050000-0x00000000050A8000-memory.dmpFilesize
352KB
-
memory/1364-56-0x00000000005D0000-0x00000000005E0000-memory.dmpFilesize
64KB
-
memory/1364-55-0x0000000076461000-0x0000000076463000-memory.dmpFilesize
8KB
-
memory/1364-54-0x00000000011B0000-0x00000000012A4000-memory.dmpFilesize
976KB