Analysis
-
max time kernel
152s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:59
Static task
static1
Behavioral task
behavioral1
Sample
invoice.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
invoice.exe
Resource
win10v2004-20220414-en
General
-
Target
invoice.exe
-
Size
661KB
-
MD5
62d71e64446c5a38e393a1fe2b57fd40
-
SHA1
29c4057c9fa750363eb70e3d92ea31f4498beeca
-
SHA256
9748273b3c0d1351dd509be12aa2f6787e385beea419de9adfd9be8f999bfa0c
-
SHA512
bc2700cb6b1e21facfadb60f90d45897bcfac4f1ebc4b2c691f275db16908adc7539dd0d7729d59a3317bd8b2e679e4c11bffe4c3633c9c695369eea3cdab079
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.tiig-eg.com - Port:
587 - Username:
[email protected] - Password:
servicelorch
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1952-65-0x0000000000400000-0x000000000045A000-memory.dmp family_agenttesla behavioral1/memory/1952-64-0x0000000000400000-0x000000000045A000-memory.dmp family_agenttesla behavioral1/memory/1952-66-0x0000000000400000-0x000000000045A000-memory.dmp family_agenttesla behavioral1/memory/1952-67-0x0000000000454B5E-mapping.dmp family_agenttesla behavioral1/memory/1952-71-0x0000000000400000-0x000000000045A000-memory.dmp family_agenttesla behavioral1/memory/1952-69-0x0000000000400000-0x000000000045A000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\sRfDVrD = "C:\\Users\\Admin\\AppData\\Roaming\\sRfDVrD\\sRfDVrD.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
invoice.exedescription pid process target process PID 1956 set thread context of 1952 1956 invoice.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
invoice.exeRegSvcs.exepid process 1956 invoice.exe 1956 invoice.exe 1956 invoice.exe 1956 invoice.exe 1952 RegSvcs.exe 1952 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
invoice.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1956 invoice.exe Token: SeDebugPrivilege 1952 RegSvcs.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
invoice.exeRegSvcs.exedescription pid process target process PID 1956 wrote to memory of 1284 1956 invoice.exe schtasks.exe PID 1956 wrote to memory of 1284 1956 invoice.exe schtasks.exe PID 1956 wrote to memory of 1284 1956 invoice.exe schtasks.exe PID 1956 wrote to memory of 1284 1956 invoice.exe schtasks.exe PID 1956 wrote to memory of 1392 1956 invoice.exe RegSvcs.exe PID 1956 wrote to memory of 1392 1956 invoice.exe RegSvcs.exe PID 1956 wrote to memory of 1392 1956 invoice.exe RegSvcs.exe PID 1956 wrote to memory of 1392 1956 invoice.exe RegSvcs.exe PID 1956 wrote to memory of 1392 1956 invoice.exe RegSvcs.exe PID 1956 wrote to memory of 1392 1956 invoice.exe RegSvcs.exe PID 1956 wrote to memory of 1392 1956 invoice.exe RegSvcs.exe PID 1956 wrote to memory of 1952 1956 invoice.exe RegSvcs.exe PID 1956 wrote to memory of 1952 1956 invoice.exe RegSvcs.exe PID 1956 wrote to memory of 1952 1956 invoice.exe RegSvcs.exe PID 1956 wrote to memory of 1952 1956 invoice.exe RegSvcs.exe PID 1956 wrote to memory of 1952 1956 invoice.exe RegSvcs.exe PID 1956 wrote to memory of 1952 1956 invoice.exe RegSvcs.exe PID 1956 wrote to memory of 1952 1956 invoice.exe RegSvcs.exe PID 1956 wrote to memory of 1952 1956 invoice.exe RegSvcs.exe PID 1956 wrote to memory of 1952 1956 invoice.exe RegSvcs.exe PID 1956 wrote to memory of 1952 1956 invoice.exe RegSvcs.exe PID 1956 wrote to memory of 1952 1956 invoice.exe RegSvcs.exe PID 1956 wrote to memory of 1952 1956 invoice.exe RegSvcs.exe PID 1952 wrote to memory of 1992 1952 RegSvcs.exe REG.exe PID 1952 wrote to memory of 1992 1952 RegSvcs.exe REG.exe PID 1952 wrote to memory of 1992 1952 RegSvcs.exe REG.exe PID 1952 wrote to memory of 1992 1952 RegSvcs.exe REG.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\invoice.exe"C:\Users\Admin\AppData\Local\Temp\invoice.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WAWdjSHDrRYnTh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp21.tmp"2⤵
- Creates scheduled task(s)
PID:1284 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵PID:1392
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1952 -
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f3⤵
- Modifies registry key
PID:1992
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp21.tmpFilesize
1KB
MD5bcff89e2ae22709825bdf587e1119eff
SHA1cc45b3ad718bef6397bcfa9cda905c66a1f63805
SHA2565d98d787b62ad580ae81d39bbb95eefc6314234d189dc423fbd1795329439659
SHA512418cde6d7dbbced6bebc12daedd2b3a8b74da2302f8e1cf923b999d9a1b02558039fdd04fb3de4ca3b7d61321c385b8138405296e107fccaa8e7895b1a688cd6
-
memory/1284-59-0x0000000000000000-mapping.dmp
-
memory/1952-67-0x0000000000454B5E-mapping.dmp
-
memory/1952-64-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1952-69-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1952-71-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1952-66-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1952-61-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1952-62-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1952-65-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1956-55-0x00000000761F1000-0x00000000761F3000-memory.dmpFilesize
8KB
-
memory/1956-57-0x00000000049F0000-0x0000000004A62000-memory.dmpFilesize
456KB
-
memory/1956-54-0x0000000000A70000-0x0000000000B1C000-memory.dmpFilesize
688KB
-
memory/1956-56-0x0000000000290000-0x000000000029A000-memory.dmpFilesize
40KB
-
memory/1956-58-0x0000000000480000-0x00000000004D8000-memory.dmpFilesize
352KB
-
memory/1992-73-0x0000000000000000-mapping.dmp