Analysis
-
max time kernel
187s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 02:54
Static task
static1
Behavioral task
behavioral1
Sample
QUOTE 002242020.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
QUOTE 002242020.exe
Resource
win10v2004-20220414-en
General
-
Target
QUOTE 002242020.exe
-
Size
2.1MB
-
MD5
bdbfa33c09b950889d9fc19954f20935
-
SHA1
d9c6cf2322734d49a1c479ff31d044ccef2f739e
-
SHA256
51558f41331f2345cd146dc9705f48e8a6fdc425e6744658ff2ea53d42d34ae6
-
SHA512
5ab3679f6c523a4a5d73678461f5089713b06fde01d59d42e2ca728d7723af01d135eba0737bf1606f105bb0a64573807cc687b8f4ba0666f4678948f1ae6fa7
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.parshavayealborz.com - Port:
587 - Username:
[email protected] - Password:
P@rshava123456
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4424-142-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
MSBuild.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts MSBuild.exe -
Drops startup file 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ReAgentc.url RegSvcs.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
MSBuild.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CpSnJ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CpSnJ\\CpSnJ.exe" MSBuild.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/4884-137-0x0000000000400000-0x0000000000579000-memory.dmp autoit_exe behavioral2/memory/4884-138-0x0000000000400000-0x0000000000579000-memory.dmp autoit_exe behavioral2/memory/4884-139-0x0000000000400000-0x0000000000579000-memory.dmp autoit_exe behavioral2/memory/4884-140-0x0000000000400000-0x0000000000579000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
QUOTE 002242020.exeRegSvcs.exeRegSvcs.exedescription pid process target process PID 392 set thread context of 2100 392 QUOTE 002242020.exe RegSvcs.exe PID 2100 set thread context of 4884 2100 RegSvcs.exe RegSvcs.exe PID 4884 set thread context of 4424 4884 RegSvcs.exe MSBuild.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
MSBuild.exeRegSvcs.exepid process 4424 MSBuild.exe 4424 MSBuild.exe 4884 RegSvcs.exe 4884 RegSvcs.exe 4884 RegSvcs.exe 4884 RegSvcs.exe 4884 RegSvcs.exe 4884 RegSvcs.exe 4884 RegSvcs.exe 4884 RegSvcs.exe 4884 RegSvcs.exe 4884 RegSvcs.exe 4884 RegSvcs.exe 4884 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 4424 MSBuild.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
RegSvcs.exepid process 4884 RegSvcs.exe 4884 RegSvcs.exe 4884 RegSvcs.exe 4884 RegSvcs.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
RegSvcs.exepid process 4884 RegSvcs.exe 4884 RegSvcs.exe 4884 RegSvcs.exe 4884 RegSvcs.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
QUOTE 002242020.exeRegSvcs.exeRegSvcs.exeMSBuild.exedescription pid process target process PID 392 wrote to memory of 2100 392 QUOTE 002242020.exe RegSvcs.exe PID 392 wrote to memory of 2100 392 QUOTE 002242020.exe RegSvcs.exe PID 392 wrote to memory of 2100 392 QUOTE 002242020.exe RegSvcs.exe PID 392 wrote to memory of 2100 392 QUOTE 002242020.exe RegSvcs.exe PID 392 wrote to memory of 2100 392 QUOTE 002242020.exe RegSvcs.exe PID 392 wrote to memory of 2100 392 QUOTE 002242020.exe RegSvcs.exe PID 392 wrote to memory of 2100 392 QUOTE 002242020.exe RegSvcs.exe PID 392 wrote to memory of 2100 392 QUOTE 002242020.exe RegSvcs.exe PID 2100 wrote to memory of 4884 2100 RegSvcs.exe RegSvcs.exe PID 2100 wrote to memory of 4884 2100 RegSvcs.exe RegSvcs.exe PID 2100 wrote to memory of 4884 2100 RegSvcs.exe RegSvcs.exe PID 2100 wrote to memory of 4884 2100 RegSvcs.exe RegSvcs.exe PID 2100 wrote to memory of 4884 2100 RegSvcs.exe RegSvcs.exe PID 2100 wrote to memory of 4884 2100 RegSvcs.exe RegSvcs.exe PID 2100 wrote to memory of 4884 2100 RegSvcs.exe RegSvcs.exe PID 2100 wrote to memory of 4884 2100 RegSvcs.exe RegSvcs.exe PID 2100 wrote to memory of 4884 2100 RegSvcs.exe RegSvcs.exe PID 2100 wrote to memory of 4884 2100 RegSvcs.exe RegSvcs.exe PID 4884 wrote to memory of 4424 4884 RegSvcs.exe MSBuild.exe PID 4884 wrote to memory of 4424 4884 RegSvcs.exe MSBuild.exe PID 4884 wrote to memory of 4424 4884 RegSvcs.exe MSBuild.exe PID 4884 wrote to memory of 4424 4884 RegSvcs.exe MSBuild.exe PID 4884 wrote to memory of 4424 4884 RegSvcs.exe MSBuild.exe PID 4424 wrote to memory of 548 4424 MSBuild.exe REG.exe PID 4424 wrote to memory of 548 4424 MSBuild.exe REG.exe PID 4424 wrote to memory of 548 4424 MSBuild.exe REG.exe PID 4424 wrote to memory of 3372 4424 MSBuild.exe netsh.exe PID 4424 wrote to memory of 3372 4424 MSBuild.exe netsh.exe PID 4424 wrote to memory of 3372 4424 MSBuild.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTE 002242020.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE 002242020.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"4⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f5⤵
- Modifies registry key
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/392-130-0x00000000007E0000-0x00000000009F4000-memory.dmpFilesize
2.1MB
-
memory/392-131-0x0000000005390000-0x000000000542C000-memory.dmpFilesize
624KB
-
memory/392-132-0x0000000005760000-0x00000000057F2000-memory.dmpFilesize
584KB
-
memory/392-133-0x0000000008D20000-0x00000000092C4000-memory.dmpFilesize
5.6MB
-
memory/548-150-0x0000000000000000-mapping.dmp
-
memory/2100-134-0x0000000000000000-mapping.dmp
-
memory/2100-135-0x0000000000400000-0x00000000005B2000-memory.dmpFilesize
1.7MB
-
memory/3372-152-0x0000000000000000-mapping.dmp
-
memory/4424-149-0x0000000005FB0000-0x0000000006016000-memory.dmpFilesize
408KB
-
memory/4424-141-0x0000000000000000-mapping.dmp
-
memory/4424-142-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4424-151-0x0000000006B60000-0x0000000006BB0000-memory.dmpFilesize
320KB
-
memory/4424-153-0x0000000006DC0000-0x0000000006DCA000-memory.dmpFilesize
40KB
-
memory/4884-139-0x0000000000400000-0x0000000000579000-memory.dmpFilesize
1.5MB
-
memory/4884-140-0x0000000000400000-0x0000000000579000-memory.dmpFilesize
1.5MB
-
memory/4884-147-0x0000000003670000-0x0000000003707000-memory.dmpFilesize
604KB
-
memory/4884-148-0x0000000004390000-0x0000000004427000-memory.dmpFilesize
604KB
-
memory/4884-138-0x0000000000400000-0x0000000000579000-memory.dmpFilesize
1.5MB
-
memory/4884-137-0x0000000000400000-0x0000000000579000-memory.dmpFilesize
1.5MB
-
memory/4884-136-0x0000000000000000-mapping.dmp