Analysis
-
max time kernel
91s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 06:06
Static task
static1
Behavioral task
behavioral1
Sample
RFQ No PH.KEA.NG 3644.2022.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
RFQ No PH.KEA.NG 3644.2022.exe
Resource
win10v2004-20220414-en
General
-
Target
RFQ No PH.KEA.NG 3644.2022.exe
-
Size
65KB
-
MD5
dec623cf8ff2b767072817cbe41967fa
-
SHA1
720d8d0495b526e170087da3a6f4adf395f69502
-
SHA256
00ab87ff45ff5e46a743254b459c58643c411fdab02b1ff908e4e323dfb75fb1
-
SHA512
7786bcd2d298ae8eb2f25a958ccad283e9b4639932100b3df0e796584eeef8e4ce06b78dcf0425b09875ca8b4a050879e74ee2d6b719b191cb53bec7806bfea8
Malware Config
Extracted
Protocol: smtp- Host:
mail.modernsystemsco.com - Port:
587 - Username:
[email protected] - Password:
Base@2222$
Extracted
agenttesla
Protocol: smtp- Host:
mail.modernsystemsco.com - Port:
587 - Username:
[email protected] - Password:
Base@2222$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
suricata: ET MALWARE AgentTesla Exfil Via SMTP
suricata: ET MALWARE AgentTesla Exfil Via SMTP
-
suricata: ET MALWARE MSIL/Kryptik.XSY Data Exfil via SMTP
suricata: ET MALWARE MSIL/Kryptik.XSY Data Exfil via SMTP
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RFQ No PH.KEA.NG 3644.2022.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation RFQ No PH.KEA.NG 3644.2022.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
MSBuild.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\newapp = "C:\\Users\\Admin\\AppData\\Roaming\\newapp\\newapp.exe" MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ No PH.KEA.NG 3644.2022.exedescription pid process target process PID 3384 set thread context of 4120 3384 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2244 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
RFQ No PH.KEA.NG 3644.2022.exeMSBuild.exepid process 3384 RFQ No PH.KEA.NG 3644.2022.exe 3384 RFQ No PH.KEA.NG 3644.2022.exe 4120 MSBuild.exe 4120 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RFQ No PH.KEA.NG 3644.2022.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 3384 RFQ No PH.KEA.NG 3644.2022.exe Token: SeDebugPrivilege 4120 MSBuild.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
RFQ No PH.KEA.NG 3644.2022.execmd.exedescription pid process target process PID 3384 wrote to memory of 2320 3384 RFQ No PH.KEA.NG 3644.2022.exe cmd.exe PID 3384 wrote to memory of 2320 3384 RFQ No PH.KEA.NG 3644.2022.exe cmd.exe PID 3384 wrote to memory of 2320 3384 RFQ No PH.KEA.NG 3644.2022.exe cmd.exe PID 2320 wrote to memory of 2244 2320 cmd.exe timeout.exe PID 2320 wrote to memory of 2244 2320 cmd.exe timeout.exe PID 2320 wrote to memory of 2244 2320 cmd.exe timeout.exe PID 3384 wrote to memory of 4120 3384 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe PID 3384 wrote to memory of 4120 3384 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe PID 3384 wrote to memory of 4120 3384 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe PID 3384 wrote to memory of 4120 3384 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe PID 3384 wrote to memory of 4120 3384 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe PID 3384 wrote to memory of 4120 3384 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe PID 3384 wrote to memory of 4120 3384 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe PID 3384 wrote to memory of 4120 3384 RFQ No PH.KEA.NG 3644.2022.exe MSBuild.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ No PH.KEA.NG 3644.2022.exe"C:\Users\Admin\AppData\Local\Temp\RFQ No PH.KEA.NG 3644.2022.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 302⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 303⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2244-132-0x0000000000000000-mapping.dmp
-
memory/2320-131-0x0000000000000000-mapping.dmp
-
memory/3384-130-0x0000000000190000-0x00000000001A6000-memory.dmpFilesize
88KB
-
memory/4120-133-0x0000000000000000-mapping.dmp
-
memory/4120-134-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4120-135-0x0000000005620000-0x0000000005BC4000-memory.dmpFilesize
5.6MB
-
memory/4120-136-0x0000000005070000-0x000000000510C000-memory.dmpFilesize
624KB
-
memory/4120-137-0x0000000005E10000-0x0000000005E76000-memory.dmpFilesize
408KB
-
memory/4120-138-0x00000000063F0000-0x0000000006440000-memory.dmpFilesize
320KB
-
memory/4120-139-0x00000000066E0000-0x0000000006772000-memory.dmpFilesize
584KB
-
memory/4120-140-0x00000000066B0000-0x00000000066BA000-memory.dmpFilesize
40KB