Analysis
-
max time kernel
148s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:13
Static task
static1
Behavioral task
behavioral1
Sample
PEDIDO Nº 865.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PEDIDO Nº 865.exe
Resource
win10v2004-20220414-en
General
-
Target
PEDIDO Nº 865.exe
-
Size
648KB
-
MD5
0034a67d2f8ca4f40c52ec3634805b34
-
SHA1
019eec77d77daa3c2db7413c581c70296ad36736
-
SHA256
0c92c000cf6c2379961f35355527b1886d053245d90a584d8d7191bcb6ebccb6
-
SHA512
7e253be95b6b3100cbeb78dfdbde939207ad839b8301bef893f04c5b12bd28ed7e162c3a2501b5d810e6de80b026ce7c979e17bd06ff0cd3491d9f0d9d488c87
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.infotaxis.tk - Port:
587 - Username:
[email protected] - Password:
?.t$K*cdh)Gj
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1684-71-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1684-72-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1684-73-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1684-74-0x0000000000446FBE-mapping.dmp family_agenttesla behavioral1/memory/1684-77-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1684-79-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Executes dropped EXE 2 IoCs
Processes:
dhclient.exeInstallUtil.exepid process 2044 dhclient.exe 1684 InstallUtil.exe -
Loads dropped DLL 2 IoCs
Processes:
PEDIDO Nº 865.exedhclient.exepid process 1496 PEDIDO Nº 865.exe 2044 dhclient.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\dhclient = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\dhclient.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
dhclient.exedescription pid process target process PID 2044 set thread context of 1684 2044 dhclient.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
PEDIDO Nº 865.exedhclient.exeInstallUtil.exepid process 1496 PEDIDO Nº 865.exe 1496 PEDIDO Nº 865.exe 2044 dhclient.exe 2044 dhclient.exe 2044 dhclient.exe 1684 InstallUtil.exe 1684 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PEDIDO Nº 865.exedhclient.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1496 PEDIDO Nº 865.exe Token: SeDebugPrivilege 2044 dhclient.exe Token: SeDebugPrivilege 1684 InstallUtil.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
PEDIDO Nº 865.execmd.exedhclient.exedescription pid process target process PID 1496 wrote to memory of 1236 1496 PEDIDO Nº 865.exe cmd.exe PID 1496 wrote to memory of 1236 1496 PEDIDO Nº 865.exe cmd.exe PID 1496 wrote to memory of 1236 1496 PEDIDO Nº 865.exe cmd.exe PID 1496 wrote to memory of 1236 1496 PEDIDO Nº 865.exe cmd.exe PID 1236 wrote to memory of 1956 1236 cmd.exe reg.exe PID 1236 wrote to memory of 1956 1236 cmd.exe reg.exe PID 1236 wrote to memory of 1956 1236 cmd.exe reg.exe PID 1236 wrote to memory of 1956 1236 cmd.exe reg.exe PID 1496 wrote to memory of 2044 1496 PEDIDO Nº 865.exe dhclient.exe PID 1496 wrote to memory of 2044 1496 PEDIDO Nº 865.exe dhclient.exe PID 1496 wrote to memory of 2044 1496 PEDIDO Nº 865.exe dhclient.exe PID 1496 wrote to memory of 2044 1496 PEDIDO Nº 865.exe dhclient.exe PID 2044 wrote to memory of 1684 2044 dhclient.exe InstallUtil.exe PID 2044 wrote to memory of 1684 2044 dhclient.exe InstallUtil.exe PID 2044 wrote to memory of 1684 2044 dhclient.exe InstallUtil.exe PID 2044 wrote to memory of 1684 2044 dhclient.exe InstallUtil.exe PID 2044 wrote to memory of 1684 2044 dhclient.exe InstallUtil.exe PID 2044 wrote to memory of 1684 2044 dhclient.exe InstallUtil.exe PID 2044 wrote to memory of 1684 2044 dhclient.exe InstallUtil.exe PID 2044 wrote to memory of 1684 2044 dhclient.exe InstallUtil.exe PID 2044 wrote to memory of 1684 2044 dhclient.exe InstallUtil.exe PID 2044 wrote to memory of 1684 2044 dhclient.exe InstallUtil.exe PID 2044 wrote to memory of 1684 2044 dhclient.exe InstallUtil.exe PID 2044 wrote to memory of 1684 2044 dhclient.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PEDIDO Nº 865.exe"C:\Users\Admin\AppData\Local\Temp\PEDIDO Nº 865.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v dhclient /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\dhclient.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v dhclient /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\dhclient.exe"3⤵
- Adds Run key to start application
PID:1956 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\dhclient.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\dhclient.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\dhclient.exeFilesize
648KB
MD50034a67d2f8ca4f40c52ec3634805b34
SHA1019eec77d77daa3c2db7413c581c70296ad36736
SHA2560c92c000cf6c2379961f35355527b1886d053245d90a584d8d7191bcb6ebccb6
SHA5127e253be95b6b3100cbeb78dfdbde939207ad839b8301bef893f04c5b12bd28ed7e162c3a2501b5d810e6de80b026ce7c979e17bd06ff0cd3491d9f0d9d488c87
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\dhclient.exeFilesize
648KB
MD50034a67d2f8ca4f40c52ec3634805b34
SHA1019eec77d77daa3c2db7413c581c70296ad36736
SHA2560c92c000cf6c2379961f35355527b1886d053245d90a584d8d7191bcb6ebccb6
SHA5127e253be95b6b3100cbeb78dfdbde939207ad839b8301bef893f04c5b12bd28ed7e162c3a2501b5d810e6de80b026ce7c979e17bd06ff0cd3491d9f0d9d488c87
-
\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\dhclient.exeFilesize
648KB
MD50034a67d2f8ca4f40c52ec3634805b34
SHA1019eec77d77daa3c2db7413c581c70296ad36736
SHA2560c92c000cf6c2379961f35355527b1886d053245d90a584d8d7191bcb6ebccb6
SHA5127e253be95b6b3100cbeb78dfdbde939207ad839b8301bef893f04c5b12bd28ed7e162c3a2501b5d810e6de80b026ce7c979e17bd06ff0cd3491d9f0d9d488c87
-
memory/1236-58-0x0000000000000000-mapping.dmp
-
memory/1496-54-0x0000000001150000-0x00000000011F8000-memory.dmpFilesize
672KB
-
memory/1496-57-0x0000000000480000-0x000000000048A000-memory.dmpFilesize
40KB
-
memory/1496-55-0x0000000075711000-0x0000000075713000-memory.dmpFilesize
8KB
-
memory/1496-56-0x0000000000420000-0x000000000043C000-memory.dmpFilesize
112KB
-
memory/1684-79-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1684-77-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1684-68-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1684-69-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1684-71-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1684-72-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1684-73-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1684-74-0x0000000000446FBE-mapping.dmp
-
memory/1956-59-0x0000000000000000-mapping.dmp
-
memory/2044-64-0x0000000001250000-0x00000000012F8000-memory.dmpFilesize
672KB
-
memory/2044-61-0x0000000000000000-mapping.dmp