Analysis
-
max time kernel
136s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 02:28
Static task
static1
Behavioral task
behavioral1
Sample
New Po.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
New Po.exe
Resource
win10v2004-20220414-en
General
-
Target
New Po.exe
-
Size
740KB
-
MD5
41661d4ec98347e7359621a526e7e976
-
SHA1
e35dddbc0fbf97a94257039941d6910ffc7615d4
-
SHA256
ffb914ef6c0c0b2077f019be5f0fc486ff611af6ba5922bb4f9a44e57565b77e
-
SHA512
e84e99a942e93892e5b5d4ceb762f2a8cdcd8926ab62b3d74a0f0c96cc33297d84700e2b2464d327ecf0de887b068444a594bcf1ce0ac1235705ec75724973e1
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
webmail.chennairealty.biz - Port:
587 - Username:
[email protected] - Password:
Mp@123cr
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1504-71-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1504-72-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1504-73-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1504-74-0x000000000044748E-mapping.dmp family_agenttesla behavioral1/memory/1504-77-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1504-79-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Executes dropped EXE 2 IoCs
Processes:
uche.exeAddInProcess32.exepid process 1248 uche.exe 1504 AddInProcess32.exe -
Loads dropped DLL 2 IoCs
Processes:
New Po.exeuche.exepid process 2012 New Po.exe 1248 uche.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\uche = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\uche.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
uche.exedescription pid process target process PID 1248 set thread context of 1504 1248 uche.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
New Po.exeuche.exepid process 2012 New Po.exe 2012 New Po.exe 1248 uche.exe 1248 uche.exe 1248 uche.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
New Po.exeuche.exedescription pid process Token: SeDebugPrivilege 2012 New Po.exe Token: SeDebugPrivilege 1248 uche.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
New Po.execmd.exeuche.exedescription pid process target process PID 2012 wrote to memory of 2044 2012 New Po.exe cmd.exe PID 2012 wrote to memory of 2044 2012 New Po.exe cmd.exe PID 2012 wrote to memory of 2044 2012 New Po.exe cmd.exe PID 2012 wrote to memory of 2044 2012 New Po.exe cmd.exe PID 2044 wrote to memory of 880 2044 cmd.exe reg.exe PID 2044 wrote to memory of 880 2044 cmd.exe reg.exe PID 2044 wrote to memory of 880 2044 cmd.exe reg.exe PID 2044 wrote to memory of 880 2044 cmd.exe reg.exe PID 2012 wrote to memory of 1248 2012 New Po.exe uche.exe PID 2012 wrote to memory of 1248 2012 New Po.exe uche.exe PID 2012 wrote to memory of 1248 2012 New Po.exe uche.exe PID 2012 wrote to memory of 1248 2012 New Po.exe uche.exe PID 1248 wrote to memory of 1504 1248 uche.exe AddInProcess32.exe PID 1248 wrote to memory of 1504 1248 uche.exe AddInProcess32.exe PID 1248 wrote to memory of 1504 1248 uche.exe AddInProcess32.exe PID 1248 wrote to memory of 1504 1248 uche.exe AddInProcess32.exe PID 1248 wrote to memory of 1504 1248 uche.exe AddInProcess32.exe PID 1248 wrote to memory of 1504 1248 uche.exe AddInProcess32.exe PID 1248 wrote to memory of 1504 1248 uche.exe AddInProcess32.exe PID 1248 wrote to memory of 1504 1248 uche.exe AddInProcess32.exe PID 1248 wrote to memory of 1504 1248 uche.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Po.exe"C:\Users\Admin\AppData\Local\Temp\New Po.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v uche /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\uche.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v uche /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\uche.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\uche.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\uche.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\uche.exeFilesize
740KB
MD541661d4ec98347e7359621a526e7e976
SHA1e35dddbc0fbf97a94257039941d6910ffc7615d4
SHA256ffb914ef6c0c0b2077f019be5f0fc486ff611af6ba5922bb4f9a44e57565b77e
SHA512e84e99a942e93892e5b5d4ceb762f2a8cdcd8926ab62b3d74a0f0c96cc33297d84700e2b2464d327ecf0de887b068444a594bcf1ce0ac1235705ec75724973e1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\uche.exeFilesize
740KB
MD541661d4ec98347e7359621a526e7e976
SHA1e35dddbc0fbf97a94257039941d6910ffc7615d4
SHA256ffb914ef6c0c0b2077f019be5f0fc486ff611af6ba5922bb4f9a44e57565b77e
SHA512e84e99a942e93892e5b5d4ceb762f2a8cdcd8926ab62b3d74a0f0c96cc33297d84700e2b2464d327ecf0de887b068444a594bcf1ce0ac1235705ec75724973e1
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\uche.exeFilesize
740KB
MD541661d4ec98347e7359621a526e7e976
SHA1e35dddbc0fbf97a94257039941d6910ffc7615d4
SHA256ffb914ef6c0c0b2077f019be5f0fc486ff611af6ba5922bb4f9a44e57565b77e
SHA512e84e99a942e93892e5b5d4ceb762f2a8cdcd8926ab62b3d74a0f0c96cc33297d84700e2b2464d327ecf0de887b068444a594bcf1ce0ac1235705ec75724973e1
-
memory/880-59-0x0000000000000000-mapping.dmp
-
memory/1248-64-0x0000000000E90000-0x0000000000F4E000-memory.dmpFilesize
760KB
-
memory/1248-61-0x0000000000000000-mapping.dmp
-
memory/1504-73-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1504-68-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1504-69-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1504-71-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1504-72-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1504-74-0x000000000044748E-mapping.dmp
-
memory/1504-77-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1504-79-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2012-54-0x0000000000E10000-0x0000000000ECE000-memory.dmpFilesize
760KB
-
memory/2012-57-0x0000000000500000-0x000000000050A000-memory.dmpFilesize
40KB
-
memory/2012-56-0x00000000004C0000-0x00000000004DC000-memory.dmpFilesize
112KB
-
memory/2012-55-0x0000000075951000-0x0000000075953000-memory.dmpFilesize
8KB
-
memory/2044-58-0x0000000000000000-mapping.dmp