Analysis
-
max time kernel
133s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:15
Static task
static1
Behavioral task
behavioral1
Sample
pictures.scr
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
pictures.scr
Resource
win10v2004-20220414-en
General
-
Target
pictures.scr
-
Size
637KB
-
MD5
0879e42f499d25bc6651cef6c74e2c42
-
SHA1
08c604275d3faafa8b6fed5a26399dc0010f8964
-
SHA256
ff556834b215cb5dc865342178c6e15e015cee26d4b601710c58264c5c76ba21
-
SHA512
b56b2daacca231c7c6fc9db0062d8a81fbb1524b0d9909d39af9be0a24bd484ac03ad5f00597846ae968c62547af04821b41d9eff9971fe09da646d8d1ad2ecc
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
bh-31.webhostbox.net - Port:
587 - Username:
[email protected] - Password:
*JP9uoO%;M%Z
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1744-68-0x0000000000400000-0x000000000044A000-memory.dmp family_agenttesla behavioral1/memory/1744-69-0x0000000000400000-0x000000000044A000-memory.dmp family_agenttesla behavioral1/memory/1744-70-0x0000000000400000-0x000000000044A000-memory.dmp family_agenttesla behavioral1/memory/1744-71-0x0000000000445D7E-mapping.dmp family_agenttesla behavioral1/memory/1744-74-0x0000000000400000-0x000000000044A000-memory.dmp family_agenttesla behavioral1/memory/1744-76-0x0000000000400000-0x000000000044A000-memory.dmp family_agenttesla -
Executes dropped EXE 2 IoCs
Processes:
computer.exeRegAsm.exepid process 1728 computer.exe 1744 RegAsm.exe -
Loads dropped DLL 3 IoCs
Processes:
pictures.scrcomputer.exeRegAsm.exepid process 548 pictures.scr 1728 computer.exe 1744 RegAsm.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\computer = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\computer.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
computer.exedescription pid process target process PID 1728 set thread context of 1744 1728 computer.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
pictures.scrcomputer.exeRegAsm.exepid process 548 pictures.scr 548 pictures.scr 1728 computer.exe 1728 computer.exe 1728 computer.exe 1744 RegAsm.exe 1744 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pictures.scrcomputer.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 548 pictures.scr Token: SeDebugPrivilege 1728 computer.exe Token: SeDebugPrivilege 1744 RegAsm.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
pictures.scrcmd.execomputer.exedescription pid process target process PID 548 wrote to memory of 2040 548 pictures.scr cmd.exe PID 548 wrote to memory of 2040 548 pictures.scr cmd.exe PID 548 wrote to memory of 2040 548 pictures.scr cmd.exe PID 548 wrote to memory of 2040 548 pictures.scr cmd.exe PID 2040 wrote to memory of 952 2040 cmd.exe reg.exe PID 2040 wrote to memory of 952 2040 cmd.exe reg.exe PID 2040 wrote to memory of 952 2040 cmd.exe reg.exe PID 2040 wrote to memory of 952 2040 cmd.exe reg.exe PID 548 wrote to memory of 1728 548 pictures.scr computer.exe PID 548 wrote to memory of 1728 548 pictures.scr computer.exe PID 548 wrote to memory of 1728 548 pictures.scr computer.exe PID 548 wrote to memory of 1728 548 pictures.scr computer.exe PID 1728 wrote to memory of 1744 1728 computer.exe RegAsm.exe PID 1728 wrote to memory of 1744 1728 computer.exe RegAsm.exe PID 1728 wrote to memory of 1744 1728 computer.exe RegAsm.exe PID 1728 wrote to memory of 1744 1728 computer.exe RegAsm.exe PID 1728 wrote to memory of 1744 1728 computer.exe RegAsm.exe PID 1728 wrote to memory of 1744 1728 computer.exe RegAsm.exe PID 1728 wrote to memory of 1744 1728 computer.exe RegAsm.exe PID 1728 wrote to memory of 1744 1728 computer.exe RegAsm.exe PID 1728 wrote to memory of 1744 1728 computer.exe RegAsm.exe PID 1728 wrote to memory of 1744 1728 computer.exe RegAsm.exe PID 1728 wrote to memory of 1744 1728 computer.exe RegAsm.exe PID 1728 wrote to memory of 1744 1728 computer.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\pictures.scr"C:\Users\Admin\AppData\Local\Temp\pictures.scr" /S1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v computer /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\computer.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v computer /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\computer.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\computer.exe"C:\Users\Admin\AppData\Roaming\computer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeFilesize
63KB
MD5b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeFilesize
63KB
MD5b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
C:\Users\Admin\AppData\Roaming\computer.exeFilesize
637KB
MD50879e42f499d25bc6651cef6c74e2c42
SHA108c604275d3faafa8b6fed5a26399dc0010f8964
SHA256ff556834b215cb5dc865342178c6e15e015cee26d4b601710c58264c5c76ba21
SHA512b56b2daacca231c7c6fc9db0062d8a81fbb1524b0d9909d39af9be0a24bd484ac03ad5f00597846ae968c62547af04821b41d9eff9971fe09da646d8d1ad2ecc
-
C:\Users\Admin\AppData\Roaming\computer.exeFilesize
637KB
MD50879e42f499d25bc6651cef6c74e2c42
SHA108c604275d3faafa8b6fed5a26399dc0010f8964
SHA256ff556834b215cb5dc865342178c6e15e015cee26d4b601710c58264c5c76ba21
SHA512b56b2daacca231c7c6fc9db0062d8a81fbb1524b0d9909d39af9be0a24bd484ac03ad5f00597846ae968c62547af04821b41d9eff9971fe09da646d8d1ad2ecc
-
\Users\Admin\AppData\Local\Temp\RegAsm.exeFilesize
63KB
MD5b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
\Users\Admin\AppData\Local\Temp\RegAsm.exeFilesize
63KB
MD5b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
\Users\Admin\AppData\Roaming\computer.exeFilesize
637KB
MD50879e42f499d25bc6651cef6c74e2c42
SHA108c604275d3faafa8b6fed5a26399dc0010f8964
SHA256ff556834b215cb5dc865342178c6e15e015cee26d4b601710c58264c5c76ba21
SHA512b56b2daacca231c7c6fc9db0062d8a81fbb1524b0d9909d39af9be0a24bd484ac03ad5f00597846ae968c62547af04821b41d9eff9971fe09da646d8d1ad2ecc
-
memory/548-55-0x00000000001B0000-0x00000000001BA000-memory.dmpFilesize
40KB
-
memory/548-54-0x00000000011B0000-0x0000000001256000-memory.dmpFilesize
664KB
-
memory/952-57-0x0000000000000000-mapping.dmp
-
memory/1728-59-0x0000000000000000-mapping.dmp
-
memory/1728-62-0x00000000003E0000-0x0000000000486000-memory.dmpFilesize
664KB
-
memory/1744-65-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1744-66-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1744-68-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1744-69-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1744-70-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1744-71-0x0000000000445D7E-mapping.dmp
-
memory/1744-74-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1744-76-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1744-77-0x0000000075D21000-0x0000000075D23000-memory.dmpFilesize
8KB
-
memory/2040-56-0x0000000000000000-mapping.dmp