Analysis
-
max time kernel
150s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:37
Static task
static1
Behavioral task
behavioral1
Sample
GFR Striff GmbH Quote Request.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
GFR Striff GmbH Quote Request.exe
Resource
win10v2004-20220414-en
General
-
Target
GFR Striff GmbH Quote Request.exe
-
Size
553KB
-
MD5
a2696acada8560e12f34664bd720decc
-
SHA1
90fba0988d19126be5f1f6ed2babe4d0f04986ef
-
SHA256
11aa22e98826cc2c74889fbfc61f54d8df27d6c83404fab1c6f4d0211bbdbeb1
-
SHA512
66d3536f64dc161e221f29820a578d1df83335986a8bfbc25ac855fab4e46b60dd880cff2bfc812d643525527fa20098d55f3adb2bf079fdcee222d352a12286
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.okgrocer.co.za - Port:
587 - Username:
[email protected] - Password:
Theunis@123
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1784-76-0x00000000000A0000-0x00000000000F2000-memory.dmp family_agenttesla behavioral1/memory/1784-77-0x00000000000A0000-0x00000000000F2000-memory.dmp family_agenttesla -
Executes dropped EXE 1 IoCs
Processes:
winservie.exepid process 1728 winservie.exe -
Loads dropped DLL 1 IoCs
Processes:
powershell.exepid process 828 powershell.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\winservie = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\winservie.exe" reg.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
GFR Striff GmbH Quote Request.exepowershell.exewinservie.exepid process 2040 GFR Striff GmbH Quote Request.exe 2040 GFR Striff GmbH Quote Request.exe 828 powershell.exe 828 powershell.exe 1728 winservie.exe 1728 winservie.exe 1728 winservie.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
GFR Striff GmbH Quote Request.exepowershell.exewinservie.exedescription pid process Token: SeDebugPrivilege 2040 GFR Striff GmbH Quote Request.exe Token: SeDebugPrivilege 828 powershell.exe Token: SeDebugPrivilege 1728 winservie.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
GFR Striff GmbH Quote Request.execmd.exepowershell.exewinservie.exedescription pid process target process PID 2040 wrote to memory of 1440 2040 GFR Striff GmbH Quote Request.exe cmd.exe PID 2040 wrote to memory of 1440 2040 GFR Striff GmbH Quote Request.exe cmd.exe PID 2040 wrote to memory of 1440 2040 GFR Striff GmbH Quote Request.exe cmd.exe PID 2040 wrote to memory of 1440 2040 GFR Striff GmbH Quote Request.exe cmd.exe PID 1440 wrote to memory of 1524 1440 cmd.exe reg.exe PID 1440 wrote to memory of 1524 1440 cmd.exe reg.exe PID 1440 wrote to memory of 1524 1440 cmd.exe reg.exe PID 1440 wrote to memory of 1524 1440 cmd.exe reg.exe PID 2040 wrote to memory of 828 2040 GFR Striff GmbH Quote Request.exe powershell.exe PID 2040 wrote to memory of 828 2040 GFR Striff GmbH Quote Request.exe powershell.exe PID 2040 wrote to memory of 828 2040 GFR Striff GmbH Quote Request.exe powershell.exe PID 2040 wrote to memory of 828 2040 GFR Striff GmbH Quote Request.exe powershell.exe PID 828 wrote to memory of 1728 828 powershell.exe winservie.exe PID 828 wrote to memory of 1728 828 powershell.exe winservie.exe PID 828 wrote to memory of 1728 828 powershell.exe winservie.exe PID 828 wrote to memory of 1728 828 powershell.exe winservie.exe PID 1728 wrote to memory of 1784 1728 winservie.exe InstallUtil.exe PID 1728 wrote to memory of 1784 1728 winservie.exe InstallUtil.exe PID 1728 wrote to memory of 1784 1728 winservie.exe InstallUtil.exe PID 1728 wrote to memory of 1784 1728 winservie.exe InstallUtil.exe PID 1728 wrote to memory of 1784 1728 winservie.exe InstallUtil.exe PID 1728 wrote to memory of 1784 1728 winservie.exe InstallUtil.exe PID 1728 wrote to memory of 1784 1728 winservie.exe InstallUtil.exe PID 1728 wrote to memory of 1784 1728 winservie.exe InstallUtil.exe PID 1728 wrote to memory of 1784 1728 winservie.exe InstallUtil.exe PID 1728 wrote to memory of 1784 1728 winservie.exe InstallUtil.exe PID 1728 wrote to memory of 1784 1728 winservie.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\GFR Striff GmbH Quote Request.exe"C:\Users\Admin\AppData\Local\Temp\GFR Striff GmbH Quote Request.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v winservie /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winservie.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v winservie /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\winservie.exe"3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process C:\Users\Admin\AppData\Roaming\winservie.exe2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\winservie.exe"C:\Users\Admin\AppData\Roaming\winservie.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\winservie.exeFilesize
553KB
MD5a2696acada8560e12f34664bd720decc
SHA190fba0988d19126be5f1f6ed2babe4d0f04986ef
SHA25611aa22e98826cc2c74889fbfc61f54d8df27d6c83404fab1c6f4d0211bbdbeb1
SHA51266d3536f64dc161e221f29820a578d1df83335986a8bfbc25ac855fab4e46b60dd880cff2bfc812d643525527fa20098d55f3adb2bf079fdcee222d352a12286
-
C:\Users\Admin\AppData\Roaming\winservie.exeFilesize
553KB
MD5a2696acada8560e12f34664bd720decc
SHA190fba0988d19126be5f1f6ed2babe4d0f04986ef
SHA25611aa22e98826cc2c74889fbfc61f54d8df27d6c83404fab1c6f4d0211bbdbeb1
SHA51266d3536f64dc161e221f29820a578d1df83335986a8bfbc25ac855fab4e46b60dd880cff2bfc812d643525527fa20098d55f3adb2bf079fdcee222d352a12286
-
\Users\Admin\AppData\Roaming\winservie.exeFilesize
553KB
MD5a2696acada8560e12f34664bd720decc
SHA190fba0988d19126be5f1f6ed2babe4d0f04986ef
SHA25611aa22e98826cc2c74889fbfc61f54d8df27d6c83404fab1c6f4d0211bbdbeb1
SHA51266d3536f64dc161e221f29820a578d1df83335986a8bfbc25ac855fab4e46b60dd880cff2bfc812d643525527fa20098d55f3adb2bf079fdcee222d352a12286
-
memory/828-62-0x0000000000000000-mapping.dmp
-
memory/828-64-0x0000000074540000-0x0000000074AEB000-memory.dmpFilesize
5.7MB
-
memory/1440-59-0x0000000000000000-mapping.dmp
-
memory/1524-60-0x0000000000000000-mapping.dmp
-
memory/1728-70-0x0000000000420000-0x0000000000436000-memory.dmpFilesize
88KB
-
memory/1728-67-0x0000000000000000-mapping.dmp
-
memory/1728-72-0x0000000000560000-0x000000000056A000-memory.dmpFilesize
40KB
-
memory/1728-69-0x0000000000C00000-0x0000000000C90000-memory.dmpFilesize
576KB
-
memory/1784-73-0x00000000000A0000-0x00000000000F2000-memory.dmpFilesize
328KB
-
memory/1784-74-0x00000000000A0000-0x00000000000F2000-memory.dmpFilesize
328KB
-
memory/1784-76-0x00000000000A0000-0x00000000000F2000-memory.dmpFilesize
328KB
-
memory/1784-77-0x00000000000A0000-0x00000000000F2000-memory.dmpFilesize
328KB
-
memory/2040-56-0x0000000076261000-0x0000000076263000-memory.dmpFilesize
8KB
-
memory/2040-55-0x00000000001E0000-0x00000000001F6000-memory.dmpFilesize
88KB
-
memory/2040-57-0x0000000000330000-0x0000000000338000-memory.dmpFilesize
32KB
-
memory/2040-61-0x00000000003C0000-0x00000000003C8000-memory.dmpFilesize
32KB
-
memory/2040-58-0x0000000000390000-0x0000000000398000-memory.dmpFilesize
32KB
-
memory/2040-54-0x0000000000280000-0x0000000000310000-memory.dmpFilesize
576KB