Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:58
Static task
static1
Behavioral task
behavioral1
Sample
MAERSK KLEVEN V.949.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
MAERSK KLEVEN V.949.exe
Resource
win10v2004-20220414-en
General
-
Target
MAERSK KLEVEN V.949.exe
-
Size
3.9MB
-
MD5
21eda5c3a9b012e0ae18f446da1b9eeb
-
SHA1
0b01392f53c0fe65952495ba14af70420d2c5853
-
SHA256
f1f8cbfc6921ce73c2c3668b2fded2a1bdb3cf8d5434f23090840115188fd7b9
-
SHA512
74ae6555b9329bc549bd686f9d861b2d09bf0030b07a1289801bef239751c770fcb3ef729e6bcf724f32a6869893bb119480d3680e78b6be5bccc770bf517c18
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.gammavilla.org - Port:
587 - Username:
[email protected] - Password:
county2018
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
MAERSK KLEVEN V.949.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\MAERSK KLEVEN V.949.exe\"" MAERSK KLEVEN V.949.exe -
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4804-151-0x0000000000400000-0x000000000044A000-memory.dmp family_agenttesla -
Drops startup file 2 IoCs
Processes:
MAERSK KLEVEN V.949.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MAERSK KLEVEN V.949.exe MAERSK KLEVEN V.949.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MAERSK KLEVEN V.949.exe MAERSK KLEVEN V.949.exe -
Processes:
MAERSK KLEVEN V.949.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features MAERSK KLEVEN V.949.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" MAERSK KLEVEN V.949.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
installutil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 installutil.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 installutil.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 installutil.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
MAERSK KLEVEN V.949.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MAERSK KLEVEN V.949.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MAERSK KLEVEN V.949.exe" MAERSK KLEVEN V.949.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
MAERSK KLEVEN V.949.exedescription pid process target process PID 2736 set thread context of 4804 2736 MAERSK KLEVEN V.949.exe installutil.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeMAERSK KLEVEN V.949.exeinstallutil.exepid process 3656 powershell.exe 3656 powershell.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 4804 installutil.exe 4804 installutil.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe 2736 MAERSK KLEVEN V.949.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeMAERSK KLEVEN V.949.exeinstallutil.exedescription pid process Token: SeDebugPrivilege 3656 powershell.exe Token: SeDebugPrivilege 2736 MAERSK KLEVEN V.949.exe Token: SeDebugPrivilege 4804 installutil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
installutil.exepid process 4804 installutil.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
MAERSK KLEVEN V.949.exedescription pid process target process PID 2736 wrote to memory of 3656 2736 MAERSK KLEVEN V.949.exe powershell.exe PID 2736 wrote to memory of 3656 2736 MAERSK KLEVEN V.949.exe powershell.exe PID 2736 wrote to memory of 3656 2736 MAERSK KLEVEN V.949.exe powershell.exe PID 2736 wrote to memory of 4804 2736 MAERSK KLEVEN V.949.exe installutil.exe PID 2736 wrote to memory of 4804 2736 MAERSK KLEVEN V.949.exe installutil.exe PID 2736 wrote to memory of 4804 2736 MAERSK KLEVEN V.949.exe installutil.exe PID 2736 wrote to memory of 4804 2736 MAERSK KLEVEN V.949.exe installutil.exe PID 2736 wrote to memory of 4804 2736 MAERSK KLEVEN V.949.exe installutil.exe PID 2736 wrote to memory of 4804 2736 MAERSK KLEVEN V.949.exe installutil.exe PID 2736 wrote to memory of 4804 2736 MAERSK KLEVEN V.949.exe installutil.exe PID 2736 wrote to memory of 4804 2736 MAERSK KLEVEN V.949.exe installutil.exe -
outlook_office_path 1 IoCs
Processes:
installutil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 installutil.exe -
outlook_win_path 1 IoCs
Processes:
installutil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 installutil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MAERSK KLEVEN V.949.exe"C:\Users\Admin\AppData\Local\Temp\MAERSK KLEVEN V.949.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2736-130-0x0000000000D80000-0x0000000001174000-memory.dmpFilesize
4.0MB
-
memory/2736-131-0x0000000005AA0000-0x0000000005B3C000-memory.dmpFilesize
624KB
-
memory/2736-132-0x0000000006160000-0x0000000006704000-memory.dmpFilesize
5.6MB
-
memory/3656-133-0x0000000000000000-mapping.dmp
-
memory/3656-134-0x0000000002540000-0x0000000002576000-memory.dmpFilesize
216KB
-
memory/3656-135-0x0000000005010000-0x0000000005638000-memory.dmpFilesize
6.2MB
-
memory/3656-136-0x0000000004FB0000-0x0000000004FD2000-memory.dmpFilesize
136KB
-
memory/3656-137-0x0000000005770000-0x00000000057D6000-memory.dmpFilesize
408KB
-
memory/3656-138-0x0000000005850000-0x00000000058B6000-memory.dmpFilesize
408KB
-
memory/3656-139-0x0000000005E70000-0x0000000005E8E000-memory.dmpFilesize
120KB
-
memory/3656-140-0x0000000007020000-0x0000000007052000-memory.dmpFilesize
200KB
-
memory/3656-141-0x0000000071120000-0x000000007116C000-memory.dmpFilesize
304KB
-
memory/3656-142-0x0000000006FE0000-0x0000000006FFE000-memory.dmpFilesize
120KB
-
memory/3656-143-0x00000000077C0000-0x0000000007E3A000-memory.dmpFilesize
6.5MB
-
memory/3656-144-0x0000000007170000-0x000000000718A000-memory.dmpFilesize
104KB
-
memory/3656-145-0x00000000071E0000-0x00000000071EA000-memory.dmpFilesize
40KB
-
memory/3656-146-0x00000000073F0000-0x0000000007486000-memory.dmpFilesize
600KB
-
memory/3656-147-0x00000000073B0000-0x00000000073BE000-memory.dmpFilesize
56KB
-
memory/3656-148-0x00000000074C0000-0x00000000074DA000-memory.dmpFilesize
104KB
-
memory/3656-149-0x00000000074A0000-0x00000000074A8000-memory.dmpFilesize
32KB
-
memory/4804-150-0x0000000000000000-mapping.dmp
-
memory/4804-151-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/4804-152-0x0000000004F70000-0x0000000005002000-memory.dmpFilesize
584KB
-
memory/4804-153-0x0000000006270000-0x00000000062C0000-memory.dmpFilesize
320KB
-
memory/4804-154-0x0000000006220000-0x000000000622A000-memory.dmpFilesize
40KB