Analysis
-
max time kernel
126s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:20
Static task
static1
Behavioral task
behavioral1
Sample
Doc-94220990687845334878-109.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Doc-94220990687845334878-109.exe
Resource
win10v2004-20220414-en
General
-
Target
Doc-94220990687845334878-109.exe
-
Size
612KB
-
MD5
369a4d5f137e2aaf60e20d636f77b743
-
SHA1
8cbdcc5df2d74e92a3f18138303af8a789e44ecc
-
SHA256
f9cdc89e99a471146ead33ee9c93bca0ecc286e65cf326c4450a9d6d8597153b
-
SHA512
b0a2ad49496de1cadb9b181ec263fa76cafbea3e7b4c221237ab07e7ad8b71f1c2d382d6843005d01a7f993b25fd685eb15ea499439303fb894a4f710856fff0
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.chenklins.com - Port:
587 - Username:
kelv@chenklins.com - Password:
7AY8Uj[tEN)a
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1004-71-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1004-72-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1004-73-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1004-74-0x0000000000446F3E-mapping.dmp family_agenttesla behavioral1/memory/1004-77-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1004-79-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Executes dropped EXE 2 IoCs
Processes:
chukwusystem.exeInstallUtil.exepid process 2036 chukwusystem.exe 1004 InstallUtil.exe -
Loads dropped DLL 2 IoCs
Processes:
Doc-94220990687845334878-109.exechukwusystem.exepid process 1212 Doc-94220990687845334878-109.exe 2036 chukwusystem.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/1212-55-0x0000000000360000-0x0000000000374000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\chukwusystem = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\chukwusystem.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
chukwusystem.exedescription pid process target process PID 2036 set thread context of 1004 2036 chukwusystem.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
Doc-94220990687845334878-109.exechukwusystem.exeInstallUtil.exepid process 1212 Doc-94220990687845334878-109.exe 1212 Doc-94220990687845334878-109.exe 2036 chukwusystem.exe 2036 chukwusystem.exe 2036 chukwusystem.exe 1004 InstallUtil.exe 1004 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Doc-94220990687845334878-109.exechukwusystem.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1212 Doc-94220990687845334878-109.exe Token: SeDebugPrivilege 2036 chukwusystem.exe Token: SeDebugPrivilege 1004 InstallUtil.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
Doc-94220990687845334878-109.execmd.exechukwusystem.exedescription pid process target process PID 1212 wrote to memory of 1688 1212 Doc-94220990687845334878-109.exe cmd.exe PID 1212 wrote to memory of 1688 1212 Doc-94220990687845334878-109.exe cmd.exe PID 1212 wrote to memory of 1688 1212 Doc-94220990687845334878-109.exe cmd.exe PID 1212 wrote to memory of 1688 1212 Doc-94220990687845334878-109.exe cmd.exe PID 1688 wrote to memory of 1648 1688 cmd.exe reg.exe PID 1688 wrote to memory of 1648 1688 cmd.exe reg.exe PID 1688 wrote to memory of 1648 1688 cmd.exe reg.exe PID 1688 wrote to memory of 1648 1688 cmd.exe reg.exe PID 1212 wrote to memory of 2036 1212 Doc-94220990687845334878-109.exe chukwusystem.exe PID 1212 wrote to memory of 2036 1212 Doc-94220990687845334878-109.exe chukwusystem.exe PID 1212 wrote to memory of 2036 1212 Doc-94220990687845334878-109.exe chukwusystem.exe PID 1212 wrote to memory of 2036 1212 Doc-94220990687845334878-109.exe chukwusystem.exe PID 2036 wrote to memory of 1004 2036 chukwusystem.exe InstallUtil.exe PID 2036 wrote to memory of 1004 2036 chukwusystem.exe InstallUtil.exe PID 2036 wrote to memory of 1004 2036 chukwusystem.exe InstallUtil.exe PID 2036 wrote to memory of 1004 2036 chukwusystem.exe InstallUtil.exe PID 2036 wrote to memory of 1004 2036 chukwusystem.exe InstallUtil.exe PID 2036 wrote to memory of 1004 2036 chukwusystem.exe InstallUtil.exe PID 2036 wrote to memory of 1004 2036 chukwusystem.exe InstallUtil.exe PID 2036 wrote to memory of 1004 2036 chukwusystem.exe InstallUtil.exe PID 2036 wrote to memory of 1004 2036 chukwusystem.exe InstallUtil.exe PID 2036 wrote to memory of 1004 2036 chukwusystem.exe InstallUtil.exe PID 2036 wrote to memory of 1004 2036 chukwusystem.exe InstallUtil.exe PID 2036 wrote to memory of 1004 2036 chukwusystem.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Doc-94220990687845334878-109.exe"C:\Users\Admin\AppData\Local\Temp\Doc-94220990687845334878-109.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v chukwusystem /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\chukwusystem.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v chukwusystem /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\chukwusystem.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\chukwusystem.exe"C:\Users\Admin\AppData\Roaming\chukwusystem.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Roaming\chukwusystem.exeFilesize
612KB
MD5369a4d5f137e2aaf60e20d636f77b743
SHA18cbdcc5df2d74e92a3f18138303af8a789e44ecc
SHA256f9cdc89e99a471146ead33ee9c93bca0ecc286e65cf326c4450a9d6d8597153b
SHA512b0a2ad49496de1cadb9b181ec263fa76cafbea3e7b4c221237ab07e7ad8b71f1c2d382d6843005d01a7f993b25fd685eb15ea499439303fb894a4f710856fff0
-
C:\Users\Admin\AppData\Roaming\chukwusystem.exeFilesize
612KB
MD5369a4d5f137e2aaf60e20d636f77b743
SHA18cbdcc5df2d74e92a3f18138303af8a789e44ecc
SHA256f9cdc89e99a471146ead33ee9c93bca0ecc286e65cf326c4450a9d6d8597153b
SHA512b0a2ad49496de1cadb9b181ec263fa76cafbea3e7b4c221237ab07e7ad8b71f1c2d382d6843005d01a7f993b25fd685eb15ea499439303fb894a4f710856fff0
-
\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
\Users\Admin\AppData\Roaming\chukwusystem.exeFilesize
612KB
MD5369a4d5f137e2aaf60e20d636f77b743
SHA18cbdcc5df2d74e92a3f18138303af8a789e44ecc
SHA256f9cdc89e99a471146ead33ee9c93bca0ecc286e65cf326c4450a9d6d8597153b
SHA512b0a2ad49496de1cadb9b181ec263fa76cafbea3e7b4c221237ab07e7ad8b71f1c2d382d6843005d01a7f993b25fd685eb15ea499439303fb894a4f710856fff0
-
memory/1004-73-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1004-74-0x0000000000446F3E-mapping.dmp
-
memory/1004-80-0x0000000075761000-0x0000000075763000-memory.dmpFilesize
8KB
-
memory/1004-79-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1004-77-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1004-72-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1004-71-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1004-69-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1004-68-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1212-56-0x0000000000370000-0x0000000000378000-memory.dmpFilesize
32KB
-
memory/1212-57-0x0000000000390000-0x0000000000398000-memory.dmpFilesize
32KB
-
memory/1212-54-0x0000000000AB0000-0x0000000000B50000-memory.dmpFilesize
640KB
-
memory/1212-55-0x0000000000360000-0x0000000000374000-memory.dmpFilesize
80KB
-
memory/1212-58-0x0000000000460000-0x0000000000468000-memory.dmpFilesize
32KB
-
memory/1648-60-0x0000000000000000-mapping.dmp
-
memory/1688-59-0x0000000000000000-mapping.dmp
-
memory/2036-65-0x0000000000180000-0x0000000000220000-memory.dmpFilesize
640KB
-
memory/2036-62-0x0000000000000000-mapping.dmp