Analysis
-
max time kernel
91s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 10:35
Static task
static1
Behavioral task
behavioral1
Sample
Order specification.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Order specification.exe
Resource
win10v2004-20220414-en
General
-
Target
Order specification.exe
-
Size
1.3MB
-
MD5
806c3237c2ea7615d9187127ab7c5d42
-
SHA1
1e3643893e5a7a2f91afc4091e1391a79988ce38
-
SHA256
3415b00698070382206702b57a7312c1eeba1f33aff4a02511eeb0fd9ce002c6
-
SHA512
5a55db591d8008a99ec40a57a4db730b5ecbccfeb02a45b4cc0f5beab65d2dc1e0a8826c0758d536fbf2b47cee64b60f978524cb0c585e9215ee11f1a3992a65
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.sarniotex.com - Port:
587 - Username:
[email protected] - Password:
dL@KoFb6
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4032-131-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Order specification.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation Order specification.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order specification.exedescription pid process target process PID 2108 set thread context of 4032 2108 Order specification.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4316 4032 WerFault.exe MSBuild.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4672 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
MSBuild.exepid process 4032 MSBuild.exe 4032 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 4032 MSBuild.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Order specification.exepid process 2108 Order specification.exe 2108 Order specification.exe 2108 Order specification.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Order specification.exepid process 2108 Order specification.exe 2108 Order specification.exe 2108 Order specification.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Order specification.execmd.exedescription pid process target process PID 2108 wrote to memory of 4032 2108 Order specification.exe MSBuild.exe PID 2108 wrote to memory of 4032 2108 Order specification.exe MSBuild.exe PID 2108 wrote to memory of 4032 2108 Order specification.exe MSBuild.exe PID 2108 wrote to memory of 4032 2108 Order specification.exe MSBuild.exe PID 2108 wrote to memory of 4032 2108 Order specification.exe MSBuild.exe PID 2108 wrote to memory of 1532 2108 Order specification.exe cmd.exe PID 2108 wrote to memory of 1532 2108 Order specification.exe cmd.exe PID 2108 wrote to memory of 1532 2108 Order specification.exe cmd.exe PID 1532 wrote to memory of 4672 1532 cmd.exe timeout.exe PID 1532 wrote to memory of 4672 1532 cmd.exe timeout.exe PID 1532 wrote to memory of 4672 1532 cmd.exe timeout.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order specification.exe"C:\Users\Admin\AppData\Local\Temp\Order specification.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 15323⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TimeOut 1 & Del /F "C:\Users\Admin\AppData\Local\Temp\Order specification.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exeTimeOut 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4032 -ip 40321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1532-138-0x0000000000000000-mapping.dmp
-
memory/2108-136-0x0000000004A90000-0x0000000004B1D000-memory.dmpFilesize
564KB
-
memory/2108-137-0x0000000004B20000-0x0000000004BAD000-memory.dmpFilesize
564KB
-
memory/4032-130-0x0000000000000000-mapping.dmp
-
memory/4032-131-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/4032-139-0x00000000060C0000-0x0000000006664000-memory.dmpFilesize
5.6MB
-
memory/4032-140-0x00000000058B0000-0x0000000005942000-memory.dmpFilesize
584KB
-
memory/4032-142-0x0000000005BB0000-0x0000000005C4C000-memory.dmpFilesize
624KB
-
memory/4032-143-0x0000000006050000-0x00000000060B6000-memory.dmpFilesize
408KB
-
memory/4032-144-0x0000000006E20000-0x0000000006E70000-memory.dmpFilesize
320KB
-
memory/4672-141-0x0000000000000000-mapping.dmp