Analysis
-
max time kernel
168s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:33
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Purchase Order.exe
Resource
win10v2004-20220414-en
General
-
Target
Purchase Order.exe
-
Size
381KB
-
MD5
20c2c7e30a36e36fc8c8db7c700e886a
-
SHA1
87fb6b5b2872a14cd66b78d0f246ea8777cb0c9a
-
SHA256
1317c9f8869b5342150133772b8399d866904c1157e5fc527b9660e676acd5f1
-
SHA512
0a00908f24e98b9366f069869e7cf25a0d95f92515c6cd18a1ab7c687ee78c31648e8710e51ea58518a94dd661ee7aac31441c638bac8bc0e9ec468a21ea564c
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.impressindia.net - Port:
587 - Username:
[email protected] - Password:
!,tR}%PDdI0N
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1932-67-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1932-68-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1932-69-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1932-70-0x000000000044C9FE-mapping.dmp family_agenttesla behavioral1/memory/1932-73-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1932-75-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla -
Executes dropped EXE 2 IoCs
Processes:
Purchase Order.exePurchase Order.exepid process 268 Purchase Order.exe 1932 Purchase Order.exe -
Loads dropped DLL 2 IoCs
Processes:
Purchase Order.exepid process 1944 Purchase Order.exe 1944 Purchase Order.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Purchase Order.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\usbutil = "\"C:\\Users\\Admin\\AppData\\Local\\usbutil.exe\"" Purchase Order.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Purchase Order.exedescription pid process target process PID 1944 set thread context of 1932 1944 Purchase Order.exe Purchase Order.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
Purchase Order.exePurchase Order.exepid process 1944 Purchase Order.exe 1944 Purchase Order.exe 1944 Purchase Order.exe 1944 Purchase Order.exe 1944 Purchase Order.exe 1944 Purchase Order.exe 1944 Purchase Order.exe 1944 Purchase Order.exe 1944 Purchase Order.exe 1944 Purchase Order.exe 1944 Purchase Order.exe 1944 Purchase Order.exe 1944 Purchase Order.exe 1944 Purchase Order.exe 1932 Purchase Order.exe 1932 Purchase Order.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Purchase Order.exePurchase Order.exedescription pid process Token: SeDebugPrivilege 1944 Purchase Order.exe Token: SeDebugPrivilege 1932 Purchase Order.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Purchase Order.exedescription pid process target process PID 1944 wrote to memory of 268 1944 Purchase Order.exe Purchase Order.exe PID 1944 wrote to memory of 268 1944 Purchase Order.exe Purchase Order.exe PID 1944 wrote to memory of 268 1944 Purchase Order.exe Purchase Order.exe PID 1944 wrote to memory of 268 1944 Purchase Order.exe Purchase Order.exe PID 1944 wrote to memory of 1932 1944 Purchase Order.exe Purchase Order.exe PID 1944 wrote to memory of 1932 1944 Purchase Order.exe Purchase Order.exe PID 1944 wrote to memory of 1932 1944 Purchase Order.exe Purchase Order.exe PID 1944 wrote to memory of 1932 1944 Purchase Order.exe Purchase Order.exe PID 1944 wrote to memory of 1932 1944 Purchase Order.exe Purchase Order.exe PID 1944 wrote to memory of 1932 1944 Purchase Order.exe Purchase Order.exe PID 1944 wrote to memory of 1932 1944 Purchase Order.exe Purchase Order.exe PID 1944 wrote to memory of 1932 1944 Purchase Order.exe Purchase Order.exe PID 1944 wrote to memory of 1932 1944 Purchase Order.exe Purchase Order.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"2⤵
- Executes dropped EXE
PID:268 -
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exeFilesize
381KB
MD520c2c7e30a36e36fc8c8db7c700e886a
SHA187fb6b5b2872a14cd66b78d0f246ea8777cb0c9a
SHA2561317c9f8869b5342150133772b8399d866904c1157e5fc527b9660e676acd5f1
SHA5120a00908f24e98b9366f069869e7cf25a0d95f92515c6cd18a1ab7c687ee78c31648e8710e51ea58518a94dd661ee7aac31441c638bac8bc0e9ec468a21ea564c
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exeFilesize
381KB
MD520c2c7e30a36e36fc8c8db7c700e886a
SHA187fb6b5b2872a14cd66b78d0f246ea8777cb0c9a
SHA2561317c9f8869b5342150133772b8399d866904c1157e5fc527b9660e676acd5f1
SHA5120a00908f24e98b9366f069869e7cf25a0d95f92515c6cd18a1ab7c687ee78c31648e8710e51ea58518a94dd661ee7aac31441c638bac8bc0e9ec468a21ea564c
-
\Users\Admin\AppData\Local\Temp\Purchase Order.exeFilesize
381KB
MD520c2c7e30a36e36fc8c8db7c700e886a
SHA187fb6b5b2872a14cd66b78d0f246ea8777cb0c9a
SHA2561317c9f8869b5342150133772b8399d866904c1157e5fc527b9660e676acd5f1
SHA5120a00908f24e98b9366f069869e7cf25a0d95f92515c6cd18a1ab7c687ee78c31648e8710e51ea58518a94dd661ee7aac31441c638bac8bc0e9ec468a21ea564c
-
\Users\Admin\AppData\Local\Temp\Purchase Order.exeFilesize
381KB
MD520c2c7e30a36e36fc8c8db7c700e886a
SHA187fb6b5b2872a14cd66b78d0f246ea8777cb0c9a
SHA2561317c9f8869b5342150133772b8399d866904c1157e5fc527b9660e676acd5f1
SHA5120a00908f24e98b9366f069869e7cf25a0d95f92515c6cd18a1ab7c687ee78c31648e8710e51ea58518a94dd661ee7aac31441c638bac8bc0e9ec468a21ea564c
-
memory/1932-67-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1932-69-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1932-75-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1932-73-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1932-70-0x000000000044C9FE-mapping.dmp
-
memory/1932-68-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1932-64-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1932-65-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1944-54-0x0000000000FD0000-0x0000000001034000-memory.dmpFilesize
400KB
-
memory/1944-56-0x0000000000B30000-0x0000000000B38000-memory.dmpFilesize
32KB
-
memory/1944-59-0x0000000000D20000-0x0000000000D36000-memory.dmpFilesize
88KB
-
memory/1944-57-0x0000000000CD0000-0x0000000000D1A000-memory.dmpFilesize
296KB
-
memory/1944-55-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/1944-58-0x0000000000C60000-0x0000000000C76000-memory.dmpFilesize
88KB
-
memory/1944-60-0x0000000000DB0000-0x0000000000DB8000-memory.dmpFilesize
32KB