Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
28-06-2022 10:02
Static task
static1
Behavioral task
behavioral1
Sample
iWBFskGDau_ori40teleevery.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
iWBFskGDau_ori40teleevery.js
Resource
win10v2004-20220414-en
General
-
Target
iWBFskGDau_ori40teleevery.js
-
Size
413KB
-
MD5
4fc2afe00fa6f77bf8c63bf48d04c49c
-
SHA1
4fe56745ef29fb87e75e05c878da2495a90b878c
-
SHA256
34ac6880e8974d521aea21df792f98ea07e4ea0f5d868847e8129e0f6b81b39b
-
SHA512
1de1febdfa9c7e79f5111a494e65c6b50d9db80088201ae83a9d85314a1e0dfbf62a4bfbdd01ec9ff737bd2fadcb35da85a18302f9cd986e758dc05f27ac26e5
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5171883538:AAEyFWuNh68SJNNpkDCQbviRgrklZA3K4Qs/sendDocument
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request 16 IoCs
Processes:
wscript.exeflow pid process 5 4064 wscript.exe 13 4064 wscript.exe 22 4064 wscript.exe 30 4064 wscript.exe 34 4064 wscript.exe 35 4064 wscript.exe 38 4064 wscript.exe 42 4064 wscript.exe 43 4064 wscript.exe 44 4064 wscript.exe 47 4064 wscript.exe 48 4064 wscript.exe 49 4064 wscript.exe 50 4064 wscript.exe 51 4064 wscript.exe 52 4064 wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
ori40teleevery.exepid process 4024 ori40teleevery.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gESLiqCqdI.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gESLiqCqdI.js wscript.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
ori40teleevery.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ori40teleevery.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ori40teleevery.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ori40teleevery.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\gESLiqCqdI.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ori40teleevery.exepid process 4024 ori40teleevery.exe 4024 ori40teleevery.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ori40teleevery.exedescription pid process Token: SeDebugPrivilege 4024 ori40teleevery.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ori40teleevery.exepid process 4024 ori40teleevery.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
wscript.exedescription pid process target process PID 2492 wrote to memory of 4064 2492 wscript.exe wscript.exe PID 2492 wrote to memory of 4064 2492 wscript.exe wscript.exe PID 2492 wrote to memory of 4024 2492 wscript.exe ori40teleevery.exe PID 2492 wrote to memory of 4024 2492 wscript.exe ori40teleevery.exe PID 2492 wrote to memory of 4024 2492 wscript.exe ori40teleevery.exe -
outlook_office_path 1 IoCs
Processes:
ori40teleevery.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ori40teleevery.exe -
outlook_win_path 1 IoCs
Processes:
ori40teleevery.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ori40teleevery.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\iWBFskGDau_ori40teleevery.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\gESLiqCqdI.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\ori40teleevery.exe"C:\Users\Admin\AppData\Local\Temp\ori40teleevery.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ori40teleevery.exeFilesize
210KB
MD5e0f80223a94ccf3f36aa16c48514f692
SHA173d3bffd145250ce91657c9d4f3f53ca97c716c0
SHA256a56acb1d690ee4deccb5f33c846f767705d5b0a84b6ee0a77aea30c81aa9da67
SHA512d5ab5e0cc0399ccc0be06eb8813e4a481d81cd4c222fc7f4553c6f3d1c4b0433a18244626600ab903842da4d6db40e2430c5dcc96ed381b7d4b7f28fd29d6ad5
-
C:\Users\Admin\AppData\Local\Temp\ori40teleevery.exeFilesize
210KB
MD5e0f80223a94ccf3f36aa16c48514f692
SHA173d3bffd145250ce91657c9d4f3f53ca97c716c0
SHA256a56acb1d690ee4deccb5f33c846f767705d5b0a84b6ee0a77aea30c81aa9da67
SHA512d5ab5e0cc0399ccc0be06eb8813e4a481d81cd4c222fc7f4553c6f3d1c4b0433a18244626600ab903842da4d6db40e2430c5dcc96ed381b7d4b7f28fd29d6ad5
-
C:\Users\Admin\AppData\Roaming\gESLiqCqdI.jsFilesize
15KB
MD5f968c7106fa42c287710c1582e45b546
SHA1f16aaafe731a57b6dc43380d4999609b89e7822c
SHA256fc71ed12fa0720f87b95ffa02fd0af75ed35edbf43030f91925be94ac20eae62
SHA512d606121022b748d4da6a50d56114f46857968829de295a3f4d46aa6fba08dbafec0549ba1c798dba1e45e1f9bdafa59165095e729490556408b4ecca49236432
-
memory/4024-132-0x0000000000000000-mapping.dmp
-
memory/4024-135-0x0000000000980000-0x00000000009BA000-memory.dmpFilesize
232KB
-
memory/4024-136-0x00000000059F0000-0x0000000005F94000-memory.dmpFilesize
5.6MB
-
memory/4024-137-0x0000000005440000-0x00000000054DC000-memory.dmpFilesize
624KB
-
memory/4024-138-0x0000000005950000-0x00000000059B6000-memory.dmpFilesize
408KB
-
memory/4024-139-0x0000000006570000-0x00000000065C0000-memory.dmpFilesize
320KB
-
memory/4024-140-0x0000000006E10000-0x0000000006EA2000-memory.dmpFilesize
584KB
-
memory/4024-141-0x0000000006DC0000-0x0000000006DCA000-memory.dmpFilesize
40KB
-
memory/4064-130-0x0000000000000000-mapping.dmp