Analysis
-
max time kernel
152s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:17
Static task
static1
Behavioral task
behavioral1
Sample
new order.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
new order.exe
Resource
win10v2004-20220414-en
General
-
Target
new order.exe
-
Size
444KB
-
MD5
9d9881934e837298eef34f31bd4fdac6
-
SHA1
1d8e4add2babcd745934a6924efc52a73edf74ee
-
SHA256
1e41a4bc1146c02cf7e2e5f2a040ad3835f4852b675bfef98eeaed0c16d8bee3
-
SHA512
d9e512b4b0765bc050218bed8efcc1c2d07313b3204d1a255cd96b5bf237666ad4f44d7cc41e3cb38b09f35e31cb420391567c27272f4c905d6a25b0785a5c78
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.yitaipackaging.com - Port:
587 - Username:
[email protected] - Password:
22799213
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/988-63-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/988-64-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/988-65-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/988-66-0x00000000004478DE-mapping.dmp family_agenttesla behavioral1/memory/988-68-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/988-70-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
new order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 new order.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 new order.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 new order.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
new order.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\gKWBf = "C:\\Users\\Admin\\AppData\\Roaming\\gKWBf\\gKWBf.exe" new order.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
new order.exedescription pid process target process PID 848 set thread context of 988 848 new order.exe new order.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
new order.exenew order.exepid process 848 new order.exe 848 new order.exe 848 new order.exe 848 new order.exe 848 new order.exe 988 new order.exe 988 new order.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
new order.exenew order.exedescription pid process Token: SeDebugPrivilege 848 new order.exe Token: SeDebugPrivilege 988 new order.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
new order.exedescription pid process target process PID 848 wrote to memory of 1732 848 new order.exe schtasks.exe PID 848 wrote to memory of 1732 848 new order.exe schtasks.exe PID 848 wrote to memory of 1732 848 new order.exe schtasks.exe PID 848 wrote to memory of 1732 848 new order.exe schtasks.exe PID 848 wrote to memory of 988 848 new order.exe new order.exe PID 848 wrote to memory of 988 848 new order.exe new order.exe PID 848 wrote to memory of 988 848 new order.exe new order.exe PID 848 wrote to memory of 988 848 new order.exe new order.exe PID 848 wrote to memory of 988 848 new order.exe new order.exe PID 848 wrote to memory of 988 848 new order.exe new order.exe PID 848 wrote to memory of 988 848 new order.exe new order.exe PID 848 wrote to memory of 988 848 new order.exe new order.exe PID 848 wrote to memory of 988 848 new order.exe new order.exe -
outlook_office_path 1 IoCs
Processes:
new order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 new order.exe -
outlook_win_path 1 IoCs
Processes:
new order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 new order.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\new order.exe"C:\Users\Admin\AppData\Local\Temp\new order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xbxCRaah" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE956.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\new order.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE956.tmpFilesize
1KB
MD5bf5b08813c3216625328e0a951a9b51a
SHA148d8b85bfaf1bf8c26eba4fae31630f2bc4e9adf
SHA2562f113421759260bc478da0df996f741948ab860ff89cf1a8b22e308a6cdc1a69
SHA51227f1fad2231ff41e89783f855413f566d2a34bbfd6750991d2685a71d5045d5b4878b91b30ebc7904f28ef3269cd251ebae9e50c531c47aff2d553090a484a47
-
memory/848-55-0x0000000000390000-0x000000000039A000-memory.dmpFilesize
40KB
-
memory/848-56-0x00000000021F0000-0x0000000002256000-memory.dmpFilesize
408KB
-
memory/848-57-0x00000000042E0000-0x000000000432C000-memory.dmpFilesize
304KB
-
memory/848-54-0x0000000000C30000-0x0000000000CA6000-memory.dmpFilesize
472KB
-
memory/988-60-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/988-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/988-63-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/988-64-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/988-65-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/988-66-0x00000000004478DE-mapping.dmp
-
memory/988-68-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/988-70-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/988-71-0x0000000075941000-0x0000000075943000-memory.dmpFilesize
8KB
-
memory/1732-58-0x0000000000000000-mapping.dmp