Analysis
-
max time kernel
99s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:53
Static task
static1
Behavioral task
behavioral1
Sample
order.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
order.exe
Resource
win10v2004-20220414-en
General
-
Target
order.exe
-
Size
933KB
-
MD5
68d4c5277ba7dc8677e0efa97d45105c
-
SHA1
25db18004d8968d97069929edce2edf21a0d0589
-
SHA256
8f31366103542395f70f39b537d8355e0f59b1605884d0ad2dae0f5c8c8a49d2
-
SHA512
76d04a5d0a17509a9b14d9371a4526c1b421b7d7d3925d0ac21d198333c0ff1c4592025c7ccdbfd8cf7ad2749b64d2f128aa904be4662451d6adf16c14cf6ef0
Malware Config
Extracted
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
1234567890Bless#
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
1234567890Bless#
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4108-137-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
order.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation order.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 order.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 order.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 order.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
order.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eJJHmLF = "C:\\Users\\Admin\\AppData\\Roaming\\eJJHmLF\\eJJHmLF.exe" order.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
order.exedescription pid process target process PID 1860 set thread context of 4108 1860 order.exe order.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
order.exeorder.exepid process 1860 order.exe 4108 order.exe 4108 order.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
order.exeorder.exedescription pid process Token: SeDebugPrivilege 1860 order.exe Token: SeDebugPrivilege 4108 order.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
order.exepid process 4108 order.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
order.exedescription pid process target process PID 1860 wrote to memory of 4848 1860 order.exe schtasks.exe PID 1860 wrote to memory of 4848 1860 order.exe schtasks.exe PID 1860 wrote to memory of 4848 1860 order.exe schtasks.exe PID 1860 wrote to memory of 4108 1860 order.exe order.exe PID 1860 wrote to memory of 4108 1860 order.exe order.exe PID 1860 wrote to memory of 4108 1860 order.exe order.exe PID 1860 wrote to memory of 4108 1860 order.exe order.exe PID 1860 wrote to memory of 4108 1860 order.exe order.exe PID 1860 wrote to memory of 4108 1860 order.exe order.exe PID 1860 wrote to memory of 4108 1860 order.exe order.exe PID 1860 wrote to memory of 4108 1860 order.exe order.exe -
outlook_office_path 1 IoCs
Processes:
order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 order.exe -
outlook_win_path 1 IoCs
Processes:
order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 order.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\order.exe"C:\Users\Admin\AppData\Local\Temp\order.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zIkjGhFzvwE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp24FD.tmp"2⤵
- Creates scheduled task(s)
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\order.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:4108
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\order.exe.logFilesize
507B
MD5ab4c71d3ff6255edd4e5c1e09540f49e
SHA122e06bf4e258741b5df918061871cba998c50cea
SHA2561690fec628f775dd3c3385b800eed126b37978ef2ffd592b024052724caafb5a
SHA5128fa7d0045796e6cda7c28e2b9a690ef550619828c1b5d0ebf8e8367aff4bf4d9f63121e5b4f199d30cb8006eb584c6767f4c59150749b8256dab9dd0ebd9f1af
-
C:\Users\Admin\AppData\Local\Temp\tmp24FD.tmpFilesize
1KB
MD5a6d8ff9c876dc91ee7c1129aa79b9039
SHA11f949a4c169f0ae0a95fc5d3f18a70d6eefa34b4
SHA2562056a8548808b31912ddd0345aff62779b11c91245f1658e0c97e435b695a939
SHA5128359b4031ba966ae698efbd3161924b3041db5ca1978f4c4e49673aa3886a3234b7709491dd7e4772a7d4cf962eaafda1e3bb7c0088fa346517d4c311d96edc6
-
memory/1860-130-0x00000000001B0000-0x000000000029E000-memory.dmpFilesize
952KB
-
memory/1860-131-0x00000000070D0000-0x000000000716C000-memory.dmpFilesize
624KB
-
memory/1860-132-0x0000000007170000-0x0000000007202000-memory.dmpFilesize
584KB
-
memory/1860-133-0x0000000007D70000-0x0000000008314000-memory.dmpFilesize
5.6MB
-
memory/4108-136-0x0000000000000000-mapping.dmp
-
memory/4108-137-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/4108-139-0x0000000006710000-0x0000000006776000-memory.dmpFilesize
408KB
-
memory/4108-140-0x0000000006F30000-0x0000000006F80000-memory.dmpFilesize
320KB
-
memory/4108-141-0x0000000007080000-0x000000000708A000-memory.dmpFilesize
40KB
-
memory/4848-134-0x0000000000000000-mapping.dmp