Analysis
-
max time kernel
141s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:45
Static task
static1
Behavioral task
behavioral1
Sample
DOC.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DOC.exe
Resource
win10v2004-20220414-en
General
-
Target
DOC.exe
-
Size
756KB
-
MD5
91d8c3dbdbe3db1041f438046e1bc0e0
-
SHA1
6bdc2ac56290abdc35be53cdc1e697166c203d81
-
SHA256
fe200cf4827d467a2915295f0b092c7afedfc13dde1381a74bb884e2baceb44c
-
SHA512
9b466c84d0c0815ead8c5691946a474daa9db3e823680acb9d0d189412b3e7dc10ecd6f1eb062637946bcef7ce1b54a1167d8c0f2abbd218c6bacb1155777e70
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.varda.com.tr - Port:
587 - Username:
info@varda.com.tr - Password:
varda9997929
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/564-63-0x0000000000400000-0x0000000000474000-memory.dmp family_agenttesla behavioral1/memory/564-65-0x0000000000400000-0x0000000000474000-memory.dmp family_agenttesla behavioral1/memory/564-66-0x0000000000400000-0x0000000000474000-memory.dmp family_agenttesla behavioral1/memory/564-67-0x0000000000446E1E-mapping.dmp family_agenttesla behavioral1/memory/564-69-0x0000000000400000-0x0000000000474000-memory.dmp family_agenttesla behavioral1/memory/564-71-0x0000000000400000-0x0000000000474000-memory.dmp family_agenttesla -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\CpSnJ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CpSnJ\\CpSnJ.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DOC.exedescription pid process target process PID 888 set thread context of 564 888 DOC.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
DOC.exeRegSvcs.exepid process 888 DOC.exe 888 DOC.exe 888 DOC.exe 888 DOC.exe 564 RegSvcs.exe 564 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
DOC.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 888 DOC.exe Token: SeDebugPrivilege 564 RegSvcs.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
DOC.exedescription pid process target process PID 888 wrote to memory of 2028 888 DOC.exe schtasks.exe PID 888 wrote to memory of 2028 888 DOC.exe schtasks.exe PID 888 wrote to memory of 2028 888 DOC.exe schtasks.exe PID 888 wrote to memory of 2028 888 DOC.exe schtasks.exe PID 888 wrote to memory of 2000 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 2000 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 2000 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 2000 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 2000 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 2000 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 2000 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 1772 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 1772 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 1772 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 1772 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 1772 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 1772 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 1772 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 1148 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 1148 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 1148 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 1148 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 1148 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 1148 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 1148 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 564 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 564 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 564 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 564 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 564 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 564 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 564 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 564 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 564 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 564 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 564 888 DOC.exe RegSvcs.exe PID 888 wrote to memory of 564 888 DOC.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DOC.exe"C:\Users\Admin\AppData\Local\Temp\DOC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cFIBIw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp515C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp515C.tmpFilesize
1KB
MD5bdb2a1f1550c8294a47d05310a52dc5c
SHA1de0da4983ffd933f4736cbdb1ab17f6f3442a66d
SHA2565ea37fa1b371716ab03c93ecdfd72986999c6a38800878aecc34fdfe0d65eb1e
SHA512b5bf2e21064b9260ee2bf7a7e39f1b5ab764d6d1772d3044cbe540ebad043b08830b59f9aed39371bfcf9ca0f687b9f32a4f3f0e487ab29d8421b2bcf7d7696a
-
memory/564-65-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/564-60-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/564-61-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/564-63-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/564-66-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/564-67-0x0000000000446E1E-mapping.dmp
-
memory/564-69-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/564-71-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/888-56-0x0000000005060000-0x00000000050DC000-memory.dmpFilesize
496KB
-
memory/888-57-0x00000000755C1000-0x00000000755C3000-memory.dmpFilesize
8KB
-
memory/888-55-0x00000000004D0000-0x00000000004DA000-memory.dmpFilesize
40KB
-
memory/888-54-0x00000000003D0000-0x0000000000494000-memory.dmpFilesize
784KB
-
memory/2028-58-0x0000000000000000-mapping.dmp