Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 02:28
Static task
static1
Behavioral task
behavioral1
Sample
New Po.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
New Po.exe
Resource
win10v2004-20220414-en
General
-
Target
New Po.exe
-
Size
740KB
-
MD5
41661d4ec98347e7359621a526e7e976
-
SHA1
e35dddbc0fbf97a94257039941d6910ffc7615d4
-
SHA256
ffb914ef6c0c0b2077f019be5f0fc486ff611af6ba5922bb4f9a44e57565b77e
-
SHA512
e84e99a942e93892e5b5d4ceb762f2a8cdcd8926ab62b3d74a0f0c96cc33297d84700e2b2464d327ecf0de887b068444a594bcf1ce0ac1235705ec75724973e1
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
webmail.chennairealty.biz - Port:
587 - Username:
[email protected] - Password:
Mp@123cr
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/740-139-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Executes dropped EXE 2 IoCs
Processes:
uche.exeAddInProcess32.exepid process 3512 uche.exe 740 AddInProcess32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
New Po.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation New Po.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uche = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\uche.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
uche.exedescription pid process target process PID 3512 set thread context of 740 3512 uche.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
New Po.exeuche.exepid process 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 4260 New Po.exe 3512 uche.exe 3512 uche.exe 3512 uche.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
New Po.exeuche.exedescription pid process Token: SeDebugPrivilege 4260 New Po.exe Token: SeDebugPrivilege 3512 uche.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
New Po.execmd.exeuche.exedescription pid process target process PID 4260 wrote to memory of 1128 4260 New Po.exe cmd.exe PID 4260 wrote to memory of 1128 4260 New Po.exe cmd.exe PID 4260 wrote to memory of 1128 4260 New Po.exe cmd.exe PID 1128 wrote to memory of 4764 1128 cmd.exe reg.exe PID 1128 wrote to memory of 4764 1128 cmd.exe reg.exe PID 1128 wrote to memory of 4764 1128 cmd.exe reg.exe PID 4260 wrote to memory of 3512 4260 New Po.exe uche.exe PID 4260 wrote to memory of 3512 4260 New Po.exe uche.exe PID 4260 wrote to memory of 3512 4260 New Po.exe uche.exe PID 3512 wrote to memory of 740 3512 uche.exe AddInProcess32.exe PID 3512 wrote to memory of 740 3512 uche.exe AddInProcess32.exe PID 3512 wrote to memory of 740 3512 uche.exe AddInProcess32.exe PID 3512 wrote to memory of 740 3512 uche.exe AddInProcess32.exe PID 3512 wrote to memory of 740 3512 uche.exe AddInProcess32.exe PID 3512 wrote to memory of 740 3512 uche.exe AddInProcess32.exe PID 3512 wrote to memory of 740 3512 uche.exe AddInProcess32.exe PID 3512 wrote to memory of 740 3512 uche.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Po.exe"C:\Users\Admin\AppData\Local\Temp\New Po.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v uche /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\uche.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v uche /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\uche.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\uche.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\uche.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\uche.exeFilesize
740KB
MD541661d4ec98347e7359621a526e7e976
SHA1e35dddbc0fbf97a94257039941d6910ffc7615d4
SHA256ffb914ef6c0c0b2077f019be5f0fc486ff611af6ba5922bb4f9a44e57565b77e
SHA512e84e99a942e93892e5b5d4ceb762f2a8cdcd8926ab62b3d74a0f0c96cc33297d84700e2b2464d327ecf0de887b068444a594bcf1ce0ac1235705ec75724973e1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\uche.exeFilesize
740KB
MD541661d4ec98347e7359621a526e7e976
SHA1e35dddbc0fbf97a94257039941d6910ffc7615d4
SHA256ffb914ef6c0c0b2077f019be5f0fc486ff611af6ba5922bb4f9a44e57565b77e
SHA512e84e99a942e93892e5b5d4ceb762f2a8cdcd8926ab62b3d74a0f0c96cc33297d84700e2b2464d327ecf0de887b068444a594bcf1ce0ac1235705ec75724973e1
-
memory/740-139-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/740-138-0x0000000000000000-mapping.dmp
-
memory/740-142-0x00000000056C0000-0x000000000575C000-memory.dmpFilesize
624KB
-
memory/1128-133-0x0000000000000000-mapping.dmp
-
memory/3512-135-0x0000000000000000-mapping.dmp
-
memory/4260-130-0x0000000000F30000-0x0000000000FEE000-memory.dmpFilesize
760KB
-
memory/4260-132-0x00000000062C0000-0x0000000006352000-memory.dmpFilesize
584KB
-
memory/4260-131-0x0000000006770000-0x0000000006D14000-memory.dmpFilesize
5.6MB
-
memory/4764-134-0x0000000000000000-mapping.dmp