Analysis
-
max time kernel
145s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:58
Static task
static1
Behavioral task
behavioral1
Sample
SIGNED AND STAMPED INVOICE.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SIGNED AND STAMPED INVOICE.exe
Resource
win10v2004-20220414-en
General
-
Target
SIGNED AND STAMPED INVOICE.exe
-
Size
461KB
-
MD5
1319cf2f252ccac65fc3d468b487593d
-
SHA1
ba35e5badeaac9233605ca750849dd3ee324413a
-
SHA256
0843dfe5e6b3266770393c129939c4fc85db09ee36dd51696fbc711a3b556460
-
SHA512
025a7cb074dbb315bb9e3366cd71a1cced563a8e17143d1cdc51d20eeb0a73d374fbc1f5f044eba2edc111a2c1970654060b55f6c1c09b8331ca9e887e4561bb
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.microtechlab.in - Port:
587 - Username:
[email protected] - Password:
pune@123
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1736-63-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1736-64-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1736-65-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1736-66-0x000000000044CF5E-mapping.dmp family_agenttesla behavioral1/memory/1736-68-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1736-70-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla -
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral1/memory/1964-57-0x0000000002130000-0x0000000002188000-memory.dmp rezer0 -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\CpSnJ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CpSnJ\\CpSnJ.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SIGNED AND STAMPED INVOICE.exedescription pid process target process PID 1964 set thread context of 1736 1964 SIGNED AND STAMPED INVOICE.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
SIGNED AND STAMPED INVOICE.exeRegSvcs.exepid process 1964 SIGNED AND STAMPED INVOICE.exe 1736 RegSvcs.exe 1736 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SIGNED AND STAMPED INVOICE.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1964 SIGNED AND STAMPED INVOICE.exe Token: SeDebugPrivilege 1736 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
SIGNED AND STAMPED INVOICE.exeRegSvcs.exedescription pid process target process PID 1964 wrote to memory of 2040 1964 SIGNED AND STAMPED INVOICE.exe schtasks.exe PID 1964 wrote to memory of 2040 1964 SIGNED AND STAMPED INVOICE.exe schtasks.exe PID 1964 wrote to memory of 2040 1964 SIGNED AND STAMPED INVOICE.exe schtasks.exe PID 1964 wrote to memory of 2040 1964 SIGNED AND STAMPED INVOICE.exe schtasks.exe PID 1964 wrote to memory of 1736 1964 SIGNED AND STAMPED INVOICE.exe RegSvcs.exe PID 1964 wrote to memory of 1736 1964 SIGNED AND STAMPED INVOICE.exe RegSvcs.exe PID 1964 wrote to memory of 1736 1964 SIGNED AND STAMPED INVOICE.exe RegSvcs.exe PID 1964 wrote to memory of 1736 1964 SIGNED AND STAMPED INVOICE.exe RegSvcs.exe PID 1964 wrote to memory of 1736 1964 SIGNED AND STAMPED INVOICE.exe RegSvcs.exe PID 1964 wrote to memory of 1736 1964 SIGNED AND STAMPED INVOICE.exe RegSvcs.exe PID 1964 wrote to memory of 1736 1964 SIGNED AND STAMPED INVOICE.exe RegSvcs.exe PID 1964 wrote to memory of 1736 1964 SIGNED AND STAMPED INVOICE.exe RegSvcs.exe PID 1964 wrote to memory of 1736 1964 SIGNED AND STAMPED INVOICE.exe RegSvcs.exe PID 1964 wrote to memory of 1736 1964 SIGNED AND STAMPED INVOICE.exe RegSvcs.exe PID 1964 wrote to memory of 1736 1964 SIGNED AND STAMPED INVOICE.exe RegSvcs.exe PID 1964 wrote to memory of 1736 1964 SIGNED AND STAMPED INVOICE.exe RegSvcs.exe PID 1736 wrote to memory of 1808 1736 RegSvcs.exe REG.exe PID 1736 wrote to memory of 1808 1736 RegSvcs.exe REG.exe PID 1736 wrote to memory of 1808 1736 RegSvcs.exe REG.exe PID 1736 wrote to memory of 1808 1736 RegSvcs.exe REG.exe PID 1736 wrote to memory of 1900 1736 RegSvcs.exe netsh.exe PID 1736 wrote to memory of 1900 1736 RegSvcs.exe netsh.exe PID 1736 wrote to memory of 1900 1736 RegSvcs.exe netsh.exe PID 1736 wrote to memory of 1900 1736 RegSvcs.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SIGNED AND STAMPED INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\SIGNED AND STAMPED INVOICE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AxUultNdoS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEE27.tmp"2⤵
- Creates scheduled task(s)
PID:2040 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1736 -
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
PID:1808 -
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵PID:1900
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpEE27.tmpFilesize
1KB
MD56203495c821c8fda9ef9583a2ddeed6f
SHA18afc16d13b22a32e9672d04bd48326627be39645
SHA256fcf6e2b67b10abc688b501cd74e1519229facd1eb2d8a471e0fed56d7f132396
SHA5129ebcff27c329a3d289586d1c995117755a91a3fbfe63489bf5233dc5e3164f1c1ea8fbbf893573c5dfb80caf340afdf56220fd1dfa83714549fde4b1d18f29b9
-
memory/1736-68-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1736-66-0x000000000044CF5E-mapping.dmp
-
memory/1736-70-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1736-63-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1736-65-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1736-60-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1736-61-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1736-64-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1808-72-0x0000000000000000-mapping.dmp
-
memory/1900-73-0x0000000000000000-mapping.dmp
-
memory/1964-56-0x00000000003C0000-0x00000000003C8000-memory.dmpFilesize
32KB
-
memory/1964-55-0x0000000075401000-0x0000000075403000-memory.dmpFilesize
8KB
-
memory/1964-54-0x0000000000CB0000-0x0000000000D2A000-memory.dmpFilesize
488KB
-
memory/1964-57-0x0000000002130000-0x0000000002188000-memory.dmpFilesize
352KB
-
memory/2040-58-0x0000000000000000-mapping.dmp