Overview
overview
10Static
static
Company Pr...df.exe
windows7_x64
10Company Pr...df.exe
windows10-2004_x64
10Invoices12...df.exe
windows7_x64
10Invoices12...df.exe
windows10-2004_x64
10Me jpg jpg...pg.exe
windows7_x64
10Me jpg jpg...pg.exe
windows10-2004_x64
10Pictures&D...pg.exe
windows7_x64
10Pictures&D...pg.exe
windows10-2004_x64
10Analysis
-
max time kernel
136s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:51
Static task
static1
Behavioral task
behavioral1
Sample
Company Profile pdf pdf pdf pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Company Profile pdf pdf pdf pdf.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
Invoices12032018 pdf pdf pdf pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
Invoices12032018 pdf pdf pdf pdf.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
Me jpg jpg jpg jpg jpg.exe
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
Me jpg jpg jpg jpg jpg.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
Pictures&Designs jpg jpg jpg jpg.exe
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
Pictures&Designs jpg jpg jpg jpg.exe
Resource
win10v2004-20220414-en
General
-
Target
Pictures&Designs jpg jpg jpg jpg.exe
-
Size
985KB
-
MD5
f18c8bfd7050c5c9e3b5490eb056281c
-
SHA1
05f0b62ff015ecb90ca36495c94842bef9a1ba45
-
SHA256
d98b551ba123d7020b8bcc1835f0bbeb103e50d18a3d341771e1a05b1edfaf87
-
SHA512
e616ede3c6514b6de6b4bee70fee764d04ea602640067cb5fb18aa00d7339c0d0f59a2b9a842cfa9fd1bc2383e9cfde217004ab247343aa959a51d181604083a
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
[email protected] - Password:
abouttomarry123
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral7/memory/1492-61-0x0000000000400000-0x0000000000466000-memory.dmp family_agenttesla behavioral7/memory/1492-62-0x0000000000400000-0x0000000000466000-memory.dmp family_agenttesla behavioral7/memory/1492-64-0x0000000000460E8E-mapping.dmp family_agenttesla behavioral7/memory/1492-63-0x0000000000400000-0x0000000000466000-memory.dmp family_agenttesla behavioral7/memory/1492-66-0x0000000000400000-0x0000000000466000-memory.dmp family_agenttesla behavioral7/memory/1492-68-0x0000000000400000-0x0000000000466000-memory.dmp family_agenttesla -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Pictures&Designs jpg jpg jpg jpg.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Pictures&Designs jpg jpg jpg jpg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Pictures&Designs jpg jpg jpg jpg.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Pictures&Designs jpg jpg jpg jpg.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Pictures&Designs jpg jpg jpg jpg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Pictures&Designs jpg jpg jpg jpg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Pictures&Designs jpg jpg jpg jpg.exedescription pid process target process PID 1680 set thread context of 1492 1680 Pictures&Designs jpg jpg jpg jpg.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Pictures&Designs jpg jpg jpg jpg.exeMSBuild.exepid process 1680 Pictures&Designs jpg jpg jpg jpg.exe 1492 MSBuild.exe 1492 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Pictures&Designs jpg jpg jpg jpg.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 1680 Pictures&Designs jpg jpg jpg jpg.exe Token: SeDebugPrivilege 1492 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MSBuild.exepid process 1492 MSBuild.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Pictures&Designs jpg jpg jpg jpg.exedescription pid process target process PID 1680 wrote to memory of 1396 1680 Pictures&Designs jpg jpg jpg jpg.exe schtasks.exe PID 1680 wrote to memory of 1396 1680 Pictures&Designs jpg jpg jpg jpg.exe schtasks.exe PID 1680 wrote to memory of 1396 1680 Pictures&Designs jpg jpg jpg jpg.exe schtasks.exe PID 1680 wrote to memory of 1396 1680 Pictures&Designs jpg jpg jpg jpg.exe schtasks.exe PID 1680 wrote to memory of 1492 1680 Pictures&Designs jpg jpg jpg jpg.exe MSBuild.exe PID 1680 wrote to memory of 1492 1680 Pictures&Designs jpg jpg jpg jpg.exe MSBuild.exe PID 1680 wrote to memory of 1492 1680 Pictures&Designs jpg jpg jpg jpg.exe MSBuild.exe PID 1680 wrote to memory of 1492 1680 Pictures&Designs jpg jpg jpg jpg.exe MSBuild.exe PID 1680 wrote to memory of 1492 1680 Pictures&Designs jpg jpg jpg jpg.exe MSBuild.exe PID 1680 wrote to memory of 1492 1680 Pictures&Designs jpg jpg jpg jpg.exe MSBuild.exe PID 1680 wrote to memory of 1492 1680 Pictures&Designs jpg jpg jpg jpg.exe MSBuild.exe PID 1680 wrote to memory of 1492 1680 Pictures&Designs jpg jpg jpg jpg.exe MSBuild.exe PID 1680 wrote to memory of 1492 1680 Pictures&Designs jpg jpg jpg jpg.exe MSBuild.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pictures&Designs jpg jpg jpg jpg.exe"C:\Users\Admin\AppData\Local\Temp\Pictures&Designs jpg jpg jpg jpg.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PLdDNErXYSoYw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpADFC.tmp"2⤵
- Creates scheduled task(s)
PID:1396 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1492
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpADFC.tmpFilesize
1KB
MD50a96230553b6d43c4713fe7846a0e8c3
SHA1c429605ec9a24059612148e6bd0edb0995eba3dd
SHA2560e775b39e427a11dfba3d384ee07439be283ae6798cc262a3b8c4a1ad16df997
SHA512c126f7d8324f67a35b89a829ae04e60cb77ce56af0d4711e5024356c8b88e972e02a80fc2a8ad3555c8b262e8d02de382aece48cd39c4bc2162cf08b341050ee
-
memory/1396-56-0x0000000000000000-mapping.dmp
-
memory/1492-61-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1492-58-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1492-59-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1492-62-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1492-64-0x0000000000460E8E-mapping.dmp
-
memory/1492-63-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1492-66-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1492-68-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1492-70-0x0000000074140000-0x00000000746EB000-memory.dmpFilesize
5.7MB
-
memory/1680-55-0x0000000074140000-0x00000000746EB000-memory.dmpFilesize
5.7MB
-
memory/1680-54-0x00000000752B1000-0x00000000752B3000-memory.dmpFilesize
8KB