Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
28-06-2022 06:00
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Document PL&BL Draft.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Shipping Document PL&BL Draft.js
Resource
win10v2004-20220414-en
General
-
Target
Shipping Document PL&BL Draft.js
-
Size
426KB
-
MD5
fd67c425734de81bb9c3162c88c6b533
-
SHA1
f014e4ee129ca9dc958282af207f2554a383df25
-
SHA256
b700763d46a1c32e807707dc7402a10894af27a76db31ef118387a65e415a9d6
-
SHA512
d5e6fd504e128f5e31c788741413224529570fc5e4a1073fcaadb12299220e2f54ff3f7672c470c1a70064aba3facbf73c1ee7beb707871a4e0e825c8c30e271
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1900836728:AAEDyoYbBJwtt1EA4hdgRlGTN1cq760KPNU/sendDocument
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\OBOMIKE4.exe family_agenttesla C:\Users\Admin\AppData\Local\Temp\OBOMIKE4.exe family_agenttesla behavioral1/memory/848-61-0x0000000001020000-0x000000000105C000-memory.dmp family_agenttesla -
Blocklisted process makes network request 16 IoCs
Processes:
wscript.exeflow pid process 4 916 wscript.exe 5 916 wscript.exe 6 916 wscript.exe 8 916 wscript.exe 10 916 wscript.exe 11 916 wscript.exe 13 916 wscript.exe 14 916 wscript.exe 15 916 wscript.exe 17 916 wscript.exe 18 916 wscript.exe 19 916 wscript.exe 21 916 wscript.exe 22 916 wscript.exe 23 916 wscript.exe 25 916 wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
OBOMIKE4.exepid process 848 OBOMIKE4.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bAMdEtWEre.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bAMdEtWEre.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\bAMdEtWEre.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
OBOMIKE4.exepid process 848 OBOMIKE4.exe 848 OBOMIKE4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
OBOMIKE4.exedescription pid process Token: SeDebugPrivilege 848 OBOMIKE4.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
wscript.exedescription pid process target process PID 1016 wrote to memory of 916 1016 wscript.exe wscript.exe PID 1016 wrote to memory of 916 1016 wscript.exe wscript.exe PID 1016 wrote to memory of 916 1016 wscript.exe wscript.exe PID 1016 wrote to memory of 848 1016 wscript.exe OBOMIKE4.exe PID 1016 wrote to memory of 848 1016 wscript.exe OBOMIKE4.exe PID 1016 wrote to memory of 848 1016 wscript.exe OBOMIKE4.exe PID 1016 wrote to memory of 848 1016 wscript.exe OBOMIKE4.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\bAMdEtWEre.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\OBOMIKE4.exe"C:\Users\Admin\AppData\Local\Temp\OBOMIKE4.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\OBOMIKE4.exeFilesize
214KB
MD509ea679f5c2a7265f399dd573799f7ec
SHA100860df49548b17be8fc13966651f0d7e4c80541
SHA25608308a421943014b117236d146c4a6514116daa0a8ae0b8379ccfe84b4f0b09c
SHA5120869871b068e061da9e8839bfb96d9464d935beb7893bd8a78e671e9c402860fdf1be557df2191436591e1320cba944e7b58e790cf29f87ba95e0fe42aff0fb6
-
C:\Users\Admin\AppData\Local\Temp\OBOMIKE4.exeFilesize
214KB
MD509ea679f5c2a7265f399dd573799f7ec
SHA100860df49548b17be8fc13966651f0d7e4c80541
SHA25608308a421943014b117236d146c4a6514116daa0a8ae0b8379ccfe84b4f0b09c
SHA5120869871b068e061da9e8839bfb96d9464d935beb7893bd8a78e671e9c402860fdf1be557df2191436591e1320cba944e7b58e790cf29f87ba95e0fe42aff0fb6
-
C:\Users\Admin\AppData\Roaming\bAMdEtWEre.jsFilesize
17KB
MD51444b44e915d4c7a53cee3f4bfc8d5e9
SHA1a6a0434b56c1967aaa75e307fa7dda3d7906c34c
SHA2564a9b17d41ff25f9752a7c5255bc11a653f930d07339e20c8e11c97fa9db013c3
SHA51226d3ffc5b6b66ccd4ee3ea11a9a1f30e64e1bc4009413e85922249d7a8957a1a4836e04d21d4c3f039e869eb81b4122f2371cba2bf34671d91b3dc0a686313d2
-
memory/848-57-0x0000000000000000-mapping.dmp
-
memory/848-61-0x0000000001020000-0x000000000105C000-memory.dmpFilesize
240KB
-
memory/848-62-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB
-
memory/916-55-0x0000000000000000-mapping.dmp
-
memory/1016-54-0x000007FEFC5C1000-0x000007FEFC5C3000-memory.dmpFilesize
8KB