Analysis
-
max time kernel
132s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:37
Static task
static1
Behavioral task
behavioral1
Sample
Amount 30,000 EUR.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Amount 30,000 EUR.exe
Resource
win10v2004-20220414-en
General
-
Target
Amount 30,000 EUR.exe
-
Size
615KB
-
MD5
6f5cc8fa4d270a910af4fe1a3200f8fa
-
SHA1
b5b4fe3824f4baf08d0bf7e19bd4f73589d4b305
-
SHA256
92937f7868601189fc7a3c51f7de21a1a16d92d2ec823cc6faf69cebc8939376
-
SHA512
b8dcede8e0506a5feab87319d345c471f3aa14fffb0c70cd94737f9147b5d6ad27dc9dce356067fef23184c5c9eacddfe9d91f5ecd0936ccf83ff92a714aa911
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cybix.in - Port:
587 - Username:
[email protected] - Password:
cybix@16july
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1380-63-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1380-64-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1380-65-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1380-66-0x00000000004470FE-mapping.dmp family_agenttesla behavioral1/memory/1380-68-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1380-70-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Amount 30,000 EUR.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Amount 30,000 EUR.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Amount 30,000 EUR.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Amount 30,000 EUR.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Amount 30,000 EUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Amount 30,000 EUR.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Amount 30,000 EUR.exedescription pid process target process PID 1900 set thread context of 1380 1900 Amount 30,000 EUR.exe Amount 30,000 EUR.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Amount 30,000 EUR.exeAmount 30,000 EUR.exepid process 1900 Amount 30,000 EUR.exe 1900 Amount 30,000 EUR.exe 1900 Amount 30,000 EUR.exe 1380 Amount 30,000 EUR.exe 1380 Amount 30,000 EUR.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Amount 30,000 EUR.exeAmount 30,000 EUR.exedescription pid process Token: SeDebugPrivilege 1900 Amount 30,000 EUR.exe Token: SeDebugPrivilege 1380 Amount 30,000 EUR.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Amount 30,000 EUR.exedescription pid process target process PID 1900 wrote to memory of 676 1900 Amount 30,000 EUR.exe schtasks.exe PID 1900 wrote to memory of 676 1900 Amount 30,000 EUR.exe schtasks.exe PID 1900 wrote to memory of 676 1900 Amount 30,000 EUR.exe schtasks.exe PID 1900 wrote to memory of 676 1900 Amount 30,000 EUR.exe schtasks.exe PID 1900 wrote to memory of 1380 1900 Amount 30,000 EUR.exe Amount 30,000 EUR.exe PID 1900 wrote to memory of 1380 1900 Amount 30,000 EUR.exe Amount 30,000 EUR.exe PID 1900 wrote to memory of 1380 1900 Amount 30,000 EUR.exe Amount 30,000 EUR.exe PID 1900 wrote to memory of 1380 1900 Amount 30,000 EUR.exe Amount 30,000 EUR.exe PID 1900 wrote to memory of 1380 1900 Amount 30,000 EUR.exe Amount 30,000 EUR.exe PID 1900 wrote to memory of 1380 1900 Amount 30,000 EUR.exe Amount 30,000 EUR.exe PID 1900 wrote to memory of 1380 1900 Amount 30,000 EUR.exe Amount 30,000 EUR.exe PID 1900 wrote to memory of 1380 1900 Amount 30,000 EUR.exe Amount 30,000 EUR.exe PID 1900 wrote to memory of 1380 1900 Amount 30,000 EUR.exe Amount 30,000 EUR.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Amount 30,000 EUR.exe"C:\Users\Admin\AppData\Local\Temp\Amount 30,000 EUR.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA89F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Amount 30,000 EUR.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA89F.tmpFilesize
1KB
MD5ab15c7fe3dc23f51a8ed4545eb54a9cb
SHA1206a5e711a5b8819deae10c568fa760a23d9308c
SHA2562889f7b15e75b474bfa37c720f216861f138e8e39e1d2f807ce751a21086674b
SHA51229b8f09dfa625fad63d6cae0fd9d9f9ea19a4b5a001138c5afb644c0d37f1cc2e7bf51a4242af433568b22b19613b1570a234474663cc659dd4ad54c7407a114
-
memory/676-58-0x0000000000000000-mapping.dmp
-
memory/1380-64-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1380-60-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1380-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1380-63-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1380-65-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1380-66-0x00000000004470FE-mapping.dmp
-
memory/1380-68-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1380-70-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1380-71-0x0000000075FB1000-0x0000000075FB3000-memory.dmpFilesize
8KB
-
memory/1900-57-0x00000000007F0000-0x0000000000846000-memory.dmpFilesize
344KB
-
memory/1900-56-0x0000000004D10000-0x0000000004D84000-memory.dmpFilesize
464KB
-
memory/1900-55-0x0000000000330000-0x0000000000338000-memory.dmpFilesize
32KB
-
memory/1900-54-0x0000000000870000-0x0000000000910000-memory.dmpFilesize
640KB