Analysis
-
max time kernel
141s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:46
Static task
static1
Behavioral task
behavioral1
Sample
P66 2020 master sheet.xlsx.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
P66 2020 master sheet.xlsx.exe
Resource
win10v2004-20220414-en
General
-
Target
P66 2020 master sheet.xlsx.exe
-
Size
695KB
-
MD5
07080c3aa5fd6d80e5681275ce15afb9
-
SHA1
75e09d1b4f40bea0b068ce79e407ba9b8e8e8ccd
-
SHA256
8580f9a8e64dff0c0d6ecbfe2b90642a972fa20bf91d1b4762ea2cc9c3433225
-
SHA512
d21099e5a4537ae609c28e1a2d2afbfbeb15ec9e947c8cc195c56a5fd5aa2b492ea2195521bdc20c6f43daefe59a1eddf7dcaa347501b3a9439a3b4f2f269c25
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mdist.us - Port:
587 - Username:
[email protected] - Password:
Receiving#4321
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1996-63-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1996-64-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1996-65-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1996-66-0x000000000044712E-mapping.dmp family_agenttesla behavioral1/memory/1996-68-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1996-70-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\CpSnJ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CpSnJ\\CpSnJ.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
P66 2020 master sheet.xlsx.exedescription pid process target process PID 884 set thread context of 1996 884 P66 2020 master sheet.xlsx.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
P66 2020 master sheet.xlsx.exeRegSvcs.exepid process 884 P66 2020 master sheet.xlsx.exe 1996 RegSvcs.exe 1996 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
P66 2020 master sheet.xlsx.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 884 P66 2020 master sheet.xlsx.exe Token: SeDebugPrivilege 1996 RegSvcs.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
P66 2020 master sheet.xlsx.exeRegSvcs.exedescription pid process target process PID 884 wrote to memory of 1056 884 P66 2020 master sheet.xlsx.exe schtasks.exe PID 884 wrote to memory of 1056 884 P66 2020 master sheet.xlsx.exe schtasks.exe PID 884 wrote to memory of 1056 884 P66 2020 master sheet.xlsx.exe schtasks.exe PID 884 wrote to memory of 1056 884 P66 2020 master sheet.xlsx.exe schtasks.exe PID 884 wrote to memory of 1996 884 P66 2020 master sheet.xlsx.exe RegSvcs.exe PID 884 wrote to memory of 1996 884 P66 2020 master sheet.xlsx.exe RegSvcs.exe PID 884 wrote to memory of 1996 884 P66 2020 master sheet.xlsx.exe RegSvcs.exe PID 884 wrote to memory of 1996 884 P66 2020 master sheet.xlsx.exe RegSvcs.exe PID 884 wrote to memory of 1996 884 P66 2020 master sheet.xlsx.exe RegSvcs.exe PID 884 wrote to memory of 1996 884 P66 2020 master sheet.xlsx.exe RegSvcs.exe PID 884 wrote to memory of 1996 884 P66 2020 master sheet.xlsx.exe RegSvcs.exe PID 884 wrote to memory of 1996 884 P66 2020 master sheet.xlsx.exe RegSvcs.exe PID 884 wrote to memory of 1996 884 P66 2020 master sheet.xlsx.exe RegSvcs.exe PID 884 wrote to memory of 1996 884 P66 2020 master sheet.xlsx.exe RegSvcs.exe PID 884 wrote to memory of 1996 884 P66 2020 master sheet.xlsx.exe RegSvcs.exe PID 884 wrote to memory of 1996 884 P66 2020 master sheet.xlsx.exe RegSvcs.exe PID 1996 wrote to memory of 1484 1996 RegSvcs.exe REG.exe PID 1996 wrote to memory of 1484 1996 RegSvcs.exe REG.exe PID 1996 wrote to memory of 1484 1996 RegSvcs.exe REG.exe PID 1996 wrote to memory of 1484 1996 RegSvcs.exe REG.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\P66 2020 master sheet.xlsx.exe"C:\Users\Admin\AppData\Local\Temp\P66 2020 master sheet.xlsx.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IZfJGinQuOdm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD653.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f3⤵
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD653.tmpFilesize
1KB
MD523baf8fb77c16fdaaf52b508cd166f58
SHA1eff5ed83cbc0d7520e00d86be4113c28a24c5b3d
SHA256c964f9c7a2ef25a191b73d1b08931eaba84c6c242e1499787883da4eac43ab11
SHA512a67a877a6401eebaf105398dc0cd8a8934317991d57db4cee06e94b7f5790d5f7f3ceb52228489bc9be0d9069240d857816c7c11fbb23af494219f07cc941537
-
memory/884-55-0x0000000074C81000-0x0000000074C83000-memory.dmpFilesize
8KB
-
memory/884-56-0x0000000000260000-0x000000000026A000-memory.dmpFilesize
40KB
-
memory/884-57-0x0000000000810000-0x0000000000864000-memory.dmpFilesize
336KB
-
memory/884-54-0x0000000000BC0000-0x0000000000C74000-memory.dmpFilesize
720KB
-
memory/1056-58-0x0000000000000000-mapping.dmp
-
memory/1484-72-0x0000000000000000-mapping.dmp
-
memory/1996-60-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1996-63-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1996-64-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1996-65-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1996-66-0x000000000044712E-mapping.dmp
-
memory/1996-68-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1996-70-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1996-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB