Analysis
-
max time kernel
66s -
max time network
76s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 06:04
Static task
static1
Behavioral task
behavioral1
Sample
RFQ No PH.KEA.NG 3644.2022.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
RFQ No PH.KEA.NG 3644.2022.exe
Resource
win10v2004-20220414-en
General
-
Target
RFQ No PH.KEA.NG 3644.2022.exe
-
Size
65KB
-
MD5
dec623cf8ff2b767072817cbe41967fa
-
SHA1
720d8d0495b526e170087da3a6f4adf395f69502
-
SHA256
00ab87ff45ff5e46a743254b459c58643c411fdab02b1ff908e4e323dfb75fb1
-
SHA512
7786bcd2d298ae8eb2f25a958ccad283e9b4639932100b3df0e796584eeef8e4ce06b78dcf0425b09875ca8b4a050879e74ee2d6b719b191cb53bec7806bfea8
Malware Config
Extracted
Protocol: smtp- Host:
mail.modernsystemsco.com - Port:
587 - Username:
[email protected] - Password:
Base@2222$
Extracted
agenttesla
Protocol: smtp- Host:
mail.modernsystemsco.com - Port:
587 - Username:
[email protected] - Password:
Base@2222$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
suricata: ET MALWARE AgentTesla Exfil Via SMTP
suricata: ET MALWARE AgentTesla Exfil Via SMTP
-
suricata: ET MALWARE MSIL/Kryptik.XSY Data Exfil via SMTP
suricata: ET MALWARE MSIL/Kryptik.XSY Data Exfil via SMTP
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
MSBuild.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\newapp = "C:\\Users\\Admin\\AppData\\Roaming\\newapp\\newapp.exe" MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ No PH.KEA.NG 3644.2022.exedescription pid process target process PID 1720 set thread context of 884 1720 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1960 timeout.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
RFQ No PH.KEA.NG 3644.2022.exeMSBuild.exepid process 1720 RFQ No PH.KEA.NG 3644.2022.exe 884 MSBuild.exe 884 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RFQ No PH.KEA.NG 3644.2022.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 1720 RFQ No PH.KEA.NG 3644.2022.exe Token: SeDebugPrivilege 884 MSBuild.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
RFQ No PH.KEA.NG 3644.2022.execmd.exedescription pid process target process PID 1720 wrote to memory of 1992 1720 RFQ No PH.KEA.NG 3644.2022.exe cmd.exe PID 1720 wrote to memory of 1992 1720 RFQ No PH.KEA.NG 3644.2022.exe cmd.exe PID 1720 wrote to memory of 1992 1720 RFQ No PH.KEA.NG 3644.2022.exe cmd.exe PID 1720 wrote to memory of 1992 1720 RFQ No PH.KEA.NG 3644.2022.exe cmd.exe PID 1992 wrote to memory of 1960 1992 cmd.exe timeout.exe PID 1992 wrote to memory of 1960 1992 cmd.exe timeout.exe PID 1992 wrote to memory of 1960 1992 cmd.exe timeout.exe PID 1992 wrote to memory of 1960 1992 cmd.exe timeout.exe PID 1720 wrote to memory of 884 1720 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe PID 1720 wrote to memory of 884 1720 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe PID 1720 wrote to memory of 884 1720 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe PID 1720 wrote to memory of 884 1720 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe PID 1720 wrote to memory of 884 1720 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe PID 1720 wrote to memory of 884 1720 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe PID 1720 wrote to memory of 884 1720 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe PID 1720 wrote to memory of 884 1720 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe PID 1720 wrote to memory of 884 1720 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ No PH.KEA.NG 3644.2022.exe"C:\Users\Admin\AppData\Local\Temp\RFQ No PH.KEA.NG 3644.2022.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 302⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\timeout.exetimeout 303⤵
- Delays execution with timeout.exe
PID:1960 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:884
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/884-60-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/884-64-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/884-68-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/884-70-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/884-66-0x0000000000435B9E-mapping.dmp
-
memory/884-63-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/884-65-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/884-61-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1720-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmpFilesize
8KB
-
memory/1720-54-0x0000000000850000-0x0000000000866000-memory.dmpFilesize
88KB
-
memory/1720-57-0x0000000000620000-0x000000000066C000-memory.dmpFilesize
304KB
-
memory/1720-56-0x0000000005400000-0x0000000005460000-memory.dmpFilesize
384KB
-
memory/1960-59-0x0000000000000000-mapping.dmp
-
memory/1992-58-0x0000000000000000-mapping.dmp