Analysis
-
max time kernel
138s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:58
Static task
static1
Behavioral task
behavioral1
Sample
SKM20064.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SKM20064.exe
Resource
win10v2004-20220414-en
General
-
Target
SKM20064.exe
-
Size
620KB
-
MD5
bdb5b41a394905200a90edf2632d469c
-
SHA1
9a5b37360aace8702a01877ded6a5bb7e0553996
-
SHA256
d7d6711fecf46a82d89b1d0ccba6e4a3cf2e5016a24671abeda65f620b8006f0
-
SHA512
ca3f710ad971e95210827790b4509613a3a83b4c987e3e45dc16ac8ae83d6bd1e3309ca4d9261cf9390031d72686dbb84e5effb9d34f8315b519b286908ed517
Malware Config
Extracted
Protocol: smtp- Host:
mail.dogulumetal.com - Port:
587 - Username:
[email protected] - Password:
DMaslak2950**
Extracted
agenttesla
Protocol: smtp- Host:
mail.dogulumetal.com - Port:
587 - Username:
[email protected] - Password:
DMaslak2950**
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4900-139-0x0000000000400000-0x0000000000458000-memory.dmp family_agenttesla -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SKM20064.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation SKM20064.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
SKM20064.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SKM20064.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SKM20064.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SKM20064.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SKM20064.exedescription pid process target process PID 4160 set thread context of 4900 4160 SKM20064.exe SKM20064.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SKM20064.exepid process 4900 SKM20064.exe 4900 SKM20064.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SKM20064.exedescription pid process Token: SeDebugPrivilege 4900 SKM20064.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
SKM20064.exepid process 4900 SKM20064.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
SKM20064.exedescription pid process target process PID 4160 wrote to memory of 3764 4160 SKM20064.exe schtasks.exe PID 4160 wrote to memory of 3764 4160 SKM20064.exe schtasks.exe PID 4160 wrote to memory of 3764 4160 SKM20064.exe schtasks.exe PID 4160 wrote to memory of 4900 4160 SKM20064.exe SKM20064.exe PID 4160 wrote to memory of 4900 4160 SKM20064.exe SKM20064.exe PID 4160 wrote to memory of 4900 4160 SKM20064.exe SKM20064.exe PID 4160 wrote to memory of 4900 4160 SKM20064.exe SKM20064.exe PID 4160 wrote to memory of 4900 4160 SKM20064.exe SKM20064.exe PID 4160 wrote to memory of 4900 4160 SKM20064.exe SKM20064.exe PID 4160 wrote to memory of 4900 4160 SKM20064.exe SKM20064.exe PID 4160 wrote to memory of 4900 4160 SKM20064.exe SKM20064.exe -
outlook_office_path 1 IoCs
Processes:
SKM20064.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SKM20064.exe -
outlook_win_path 1 IoCs
Processes:
SKM20064.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SKM20064.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SKM20064.exe"C:\Users\Admin\AppData\Local\Temp\SKM20064.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XNpmrzTl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD031.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SKM20064.exe"C:\Users\Admin\AppData\Local\Temp\SKM20064.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SKM20064.exe.logFilesize
1KB
MD517573558c4e714f606f997e5157afaac
SHA113e16e9415ceef429aaf124139671ebeca09ed23
SHA256c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
SHA512f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
-
C:\Users\Admin\AppData\Local\Temp\tmpD031.tmpFilesize
1KB
MD52f89cd2545d2b290c26507d6973dd9cf
SHA12356bd95bdd4864cde5c0d06b460b1c3ad3fe62a
SHA25640393992958af429278726dab4cdebc53ced588182ab2f778e02abe8b5ae7480
SHA5120c14985d511c070777d68e14d0d74d4ff3eb96868c927bdde637403c4e6a10249fa6c86f853b1a97e592bd89a877cb907de4c1c637d0e6d27ab8b1d3db6a8b23
-
memory/3764-136-0x0000000000000000-mapping.dmp
-
memory/4160-133-0x0000000005200000-0x0000000005292000-memory.dmpFilesize
584KB
-
memory/4160-134-0x00000000050E0000-0x00000000050EA000-memory.dmpFilesize
40KB
-
memory/4160-135-0x00000000052A0000-0x00000000052F6000-memory.dmpFilesize
344KB
-
memory/4160-130-0x0000000000690000-0x0000000000732000-memory.dmpFilesize
648KB
-
memory/4160-132-0x00000000057B0000-0x0000000005D54000-memory.dmpFilesize
5.6MB
-
memory/4160-131-0x0000000005160000-0x00000000051FC000-memory.dmpFilesize
624KB
-
memory/4900-138-0x0000000000000000-mapping.dmp
-
memory/4900-139-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4900-141-0x00000000061D0000-0x0000000006236000-memory.dmpFilesize
408KB
-
memory/4900-142-0x0000000006EF0000-0x0000000006F40000-memory.dmpFilesize
320KB