Analysis
-
max time kernel
131s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 00:59
Static task
static1
Behavioral task
behavioral1
Sample
invoice.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
invoice.exe
Resource
win10v2004-20220414-en
General
-
Target
invoice.exe
-
Size
661KB
-
MD5
62d71e64446c5a38e393a1fe2b57fd40
-
SHA1
29c4057c9fa750363eb70e3d92ea31f4498beeca
-
SHA256
9748273b3c0d1351dd509be12aa2f6787e385beea419de9adfd9be8f999bfa0c
-
SHA512
bc2700cb6b1e21facfadb60f90d45897bcfac4f1ebc4b2c691f275db16908adc7539dd0d7729d59a3317bd8b2e679e4c11bffe4c3633c9c695369eea3cdab079
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.tiig-eg.com - Port:
587 - Username:
[email protected] - Password:
servicelorch
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2112-139-0x0000000000400000-0x000000000045A000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
invoice.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation invoice.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sRfDVrD = "C:\\Users\\Admin\\AppData\\Roaming\\sRfDVrD\\sRfDVrD.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
invoice.exedescription pid process target process PID 2368 set thread context of 2112 2368 invoice.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
invoice.exeRegSvcs.exepid process 2368 invoice.exe 2368 invoice.exe 2368 invoice.exe 2368 invoice.exe 2368 invoice.exe 2368 invoice.exe 2112 RegSvcs.exe 2112 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
invoice.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2368 invoice.exe Token: SeDebugPrivilege 2112 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
invoice.exeRegSvcs.exedescription pid process target process PID 2368 wrote to memory of 5048 2368 invoice.exe schtasks.exe PID 2368 wrote to memory of 5048 2368 invoice.exe schtasks.exe PID 2368 wrote to memory of 5048 2368 invoice.exe schtasks.exe PID 2368 wrote to memory of 4748 2368 invoice.exe RegSvcs.exe PID 2368 wrote to memory of 4748 2368 invoice.exe RegSvcs.exe PID 2368 wrote to memory of 4748 2368 invoice.exe RegSvcs.exe PID 2368 wrote to memory of 2112 2368 invoice.exe RegSvcs.exe PID 2368 wrote to memory of 2112 2368 invoice.exe RegSvcs.exe PID 2368 wrote to memory of 2112 2368 invoice.exe RegSvcs.exe PID 2368 wrote to memory of 2112 2368 invoice.exe RegSvcs.exe PID 2368 wrote to memory of 2112 2368 invoice.exe RegSvcs.exe PID 2368 wrote to memory of 2112 2368 invoice.exe RegSvcs.exe PID 2368 wrote to memory of 2112 2368 invoice.exe RegSvcs.exe PID 2368 wrote to memory of 2112 2368 invoice.exe RegSvcs.exe PID 2112 wrote to memory of 1624 2112 RegSvcs.exe REG.exe PID 2112 wrote to memory of 1624 2112 RegSvcs.exe REG.exe PID 2112 wrote to memory of 1624 2112 RegSvcs.exe REG.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\invoice.exe"C:\Users\Admin\AppData\Local\Temp\invoice.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WAWdjSHDrRYnTh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7B89.tmp"2⤵
- Creates scheduled task(s)
PID:5048 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵PID:4748
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2112 -
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f3⤵
- Modifies registry key
PID:1624
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7B89.tmpFilesize
1KB
MD5d761900105470ec543ec81bad5b46cc4
SHA11e4a4d66ede7a1a43d660210bf4ee078b74c2f1b
SHA25629c9757e10a5ebd34c388baa35b87dec0c8a4469ca1e7bd15450b7149c4b4b2e
SHA5124b716a99978a9b2aadd45f1474b59b29192331fb211219e98debfe73146dd524159c3f2d8844c0add0445c3fa8441efb395ef5d14bc972b2bc83c12b28b22423
-
memory/1624-142-0x0000000000000000-mapping.dmp
-
memory/2112-139-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/2112-138-0x0000000000000000-mapping.dmp
-
memory/2112-140-0x0000000005720000-0x0000000005786000-memory.dmpFilesize
408KB
-
memory/2112-141-0x00000000062C0000-0x0000000006310000-memory.dmpFilesize
320KB
-
memory/2368-133-0x0000000007580000-0x000000000758A000-memory.dmpFilesize
40KB
-
memory/2368-134-0x00000000098E0000-0x000000000997C000-memory.dmpFilesize
624KB
-
memory/2368-132-0x00000000073F0000-0x0000000007482000-memory.dmpFilesize
584KB
-
memory/2368-130-0x00000000004C0000-0x000000000056C000-memory.dmpFilesize
688KB
-
memory/2368-131-0x00000000078C0000-0x0000000007E64000-memory.dmpFilesize
5.6MB
-
memory/4748-137-0x0000000000000000-mapping.dmp
-
memory/5048-135-0x0000000000000000-mapping.dmp