Analysis
-
max time kernel
92s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
30-06-2022 17:06
Static task
static1
Behavioral task
behavioral1
Sample
18d5927d197f41af4d9b16621b0515a6.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
18d5927d197f41af4d9b16621b0515a6.exe
Resource
win10v2004-20220414-en
General
-
Target
18d5927d197f41af4d9b16621b0515a6.exe
-
Size
172KB
-
MD5
18d5927d197f41af4d9b16621b0515a6
-
SHA1
d2f4345de440d781b22f3ecf5b922783b4264bdd
-
SHA256
613113ce85195ad4ee1d48d212424be5719d697429f2cfe422752e056d2236c0
-
SHA512
60dde5e043e91469135829aa1590d7e505644fa22a675a205e5cc40e507b27b06e6fcfcc418b72fc8752a788ce51fd8ee3919fa4534ae94bf889db948b50e24b
Malware Config
Extracted
agenttesla
http://136.144.41.76/bray/inc/a4a9ffb236214a.php
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:1111
62.197.136.167:6606
62.197.136.167:7707
62.197.136.167:8808
62.197.136.167:1111
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
suricata: ET MALWARE AgentTesla Communicating with CnC Server
suricata: ET MALWARE AgentTesla Communicating with CnC Server
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2216-161-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Drops file in Drivers directory 1 IoCs
Processes:
InstallUtil.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts InstallUtil.exe -
Executes dropped EXE 1 IoCs
Processes:
Crstwuze5m.exepid process 3652 Crstwuze5m.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
18d5927d197f41af4d9b16621b0515a6.exeCrstwuze5m.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 18d5927d197f41af4d9b16621b0515a6.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation Crstwuze5m.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
18d5927d197f41af4d9b16621b0515a6.exeCrstwuze5m.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aeigqqh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tupbtqbro\\Aeigqqh.exe\"" 18d5927d197f41af4d9b16621b0515a6.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aeigqqh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tupbtqbro\\Aeigqqh.exe\"" Crstwuze5m.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
18d5927d197f41af4d9b16621b0515a6.exeCrstwuze5m.exedescription pid process target process PID 4116 set thread context of 4764 4116 18d5927d197f41af4d9b16621b0515a6.exe InstallUtil.exe PID 3652 set thread context of 2216 3652 Crstwuze5m.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
powershell.exepowershell.exe18d5927d197f41af4d9b16621b0515a6.exepowershell.exeInstallUtil.exepowershell.exeCrstwuze5m.exepid process 4288 powershell.exe 4288 powershell.exe 1924 powershell.exe 1924 powershell.exe 4116 18d5927d197f41af4d9b16621b0515a6.exe 4116 18d5927d197f41af4d9b16621b0515a6.exe 1312 powershell.exe 4764 InstallUtil.exe 4764 InstallUtil.exe 1312 powershell.exe 2768 powershell.exe 2768 powershell.exe 3652 Crstwuze5m.exe 3652 Crstwuze5m.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
powershell.exe18d5927d197f41af4d9b16621b0515a6.exepowershell.exeInstallUtil.exepowershell.exeCrstwuze5m.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 4288 powershell.exe Token: SeDebugPrivilege 4116 18d5927d197f41af4d9b16621b0515a6.exe Token: SeDebugPrivilege 1924 powershell.exe Token: SeDebugPrivilege 4764 InstallUtil.exe Token: SeDebugPrivilege 1312 powershell.exe Token: SeDebugPrivilege 3652 Crstwuze5m.exe Token: SeDebugPrivilege 2768 powershell.exe Token: SeDebugPrivilege 2216 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 4764 InstallUtil.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
18d5927d197f41af4d9b16621b0515a6.exeCrstwuze5m.exedescription pid process target process PID 4116 wrote to memory of 4288 4116 18d5927d197f41af4d9b16621b0515a6.exe powershell.exe PID 4116 wrote to memory of 4288 4116 18d5927d197f41af4d9b16621b0515a6.exe powershell.exe PID 4116 wrote to memory of 4288 4116 18d5927d197f41af4d9b16621b0515a6.exe powershell.exe PID 4116 wrote to memory of 1924 4116 18d5927d197f41af4d9b16621b0515a6.exe powershell.exe PID 4116 wrote to memory of 1924 4116 18d5927d197f41af4d9b16621b0515a6.exe powershell.exe PID 4116 wrote to memory of 1924 4116 18d5927d197f41af4d9b16621b0515a6.exe powershell.exe PID 4116 wrote to memory of 3652 4116 18d5927d197f41af4d9b16621b0515a6.exe Crstwuze5m.exe PID 4116 wrote to memory of 3652 4116 18d5927d197f41af4d9b16621b0515a6.exe Crstwuze5m.exe PID 4116 wrote to memory of 3652 4116 18d5927d197f41af4d9b16621b0515a6.exe Crstwuze5m.exe PID 3652 wrote to memory of 1312 3652 Crstwuze5m.exe powershell.exe PID 3652 wrote to memory of 1312 3652 Crstwuze5m.exe powershell.exe PID 3652 wrote to memory of 1312 3652 Crstwuze5m.exe powershell.exe PID 4116 wrote to memory of 4764 4116 18d5927d197f41af4d9b16621b0515a6.exe InstallUtil.exe PID 4116 wrote to memory of 4764 4116 18d5927d197f41af4d9b16621b0515a6.exe InstallUtil.exe PID 4116 wrote to memory of 4764 4116 18d5927d197f41af4d9b16621b0515a6.exe InstallUtil.exe PID 4116 wrote to memory of 4764 4116 18d5927d197f41af4d9b16621b0515a6.exe InstallUtil.exe PID 4116 wrote to memory of 4764 4116 18d5927d197f41af4d9b16621b0515a6.exe InstallUtil.exe PID 4116 wrote to memory of 4764 4116 18d5927d197f41af4d9b16621b0515a6.exe InstallUtil.exe PID 4116 wrote to memory of 4764 4116 18d5927d197f41af4d9b16621b0515a6.exe InstallUtil.exe PID 4116 wrote to memory of 4764 4116 18d5927d197f41af4d9b16621b0515a6.exe InstallUtil.exe PID 3652 wrote to memory of 2768 3652 Crstwuze5m.exe powershell.exe PID 3652 wrote to memory of 2768 3652 Crstwuze5m.exe powershell.exe PID 3652 wrote to memory of 2768 3652 Crstwuze5m.exe powershell.exe PID 3652 wrote to memory of 2216 3652 Crstwuze5m.exe InstallUtil.exe PID 3652 wrote to memory of 2216 3652 Crstwuze5m.exe InstallUtil.exe PID 3652 wrote to memory of 2216 3652 Crstwuze5m.exe InstallUtil.exe PID 3652 wrote to memory of 2216 3652 Crstwuze5m.exe InstallUtil.exe PID 3652 wrote to memory of 2216 3652 Crstwuze5m.exe InstallUtil.exe PID 3652 wrote to memory of 2216 3652 Crstwuze5m.exe InstallUtil.exe PID 3652 wrote to memory of 2216 3652 Crstwuze5m.exe InstallUtil.exe PID 3652 wrote to memory of 2216 3652 Crstwuze5m.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18d5927d197f41af4d9b16621b0515a6.exe"C:\Users\Admin\AppData\Local\Temp\18d5927d197f41af4d9b16621b0515a6.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Crstwuze5m.exe"C:\Users\Admin\AppData\Local\Temp\Crstwuze5m.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD53337d66209faa998d52d781d0ff2d804
SHA16594b85a70f998f79f43cdf1ca56137997534156
SHA2569b946b062865f68b9f0f43a011d33d7ea0926a3c8f78fb20d9cab6144314e1bd
SHA5128bbd14bd73111f7b55712f5d1e1b727e41db8e6e0c1243ee6809ff32b509e52dec7af34c064151fb5beccd59dda434a3f83abe987c561a25abfbb4cbcf9c7f1f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
15KB
MD59e2a9ecaec0b5e4f529aaaa9be9245ae
SHA1c5f0ba7809bfede3f4dc40408e2686e103bd87d1
SHA256a73e02d4a2f3814ed90cdd808c3c1d891ed6eebfa2041a9f7d25ad41c08dbda0
SHA51211948c56c9fc5917292bd271fd19090f2c78be8431558009b0d8045cf695fa28c93f40418f65a51ba80608983fdb47063e89fbcf14fcd784a2ae282d088af686
-
C:\Users\Admin\AppData\Local\Temp\Crstwuze5m.exeFilesize
172KB
MD5982f97ccf89f9d50dbc5d152c7139a50
SHA10ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1
-
C:\Users\Admin\AppData\Local\Temp\Crstwuze5m.exeFilesize
172KB
MD5982f97ccf89f9d50dbc5d152c7139a50
SHA10ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1
-
C:\Users\Admin\AppData\Roaming\Tupbtqbro\Aeigqqh.exeFilesize
172KB
MD5982f97ccf89f9d50dbc5d152c7139a50
SHA10ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1
-
memory/1312-151-0x0000000000000000-mapping.dmp
-
memory/1924-145-0x0000000000000000-mapping.dmp
-
memory/2216-160-0x0000000000000000-mapping.dmp
-
memory/2216-161-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2768-157-0x0000000000000000-mapping.dmp
-
memory/3652-150-0x0000000000D80000-0x0000000000DB0000-memory.dmpFilesize
192KB
-
memory/3652-147-0x0000000000000000-mapping.dmp
-
memory/4116-131-0x0000000005150000-0x00000000056F4000-memory.dmpFilesize
5.6MB
-
memory/4116-132-0x0000000004BA0000-0x0000000004C32000-memory.dmpFilesize
584KB
-
memory/4116-130-0x00000000001D0000-0x0000000000200000-memory.dmpFilesize
192KB
-
memory/4116-133-0x0000000004C40000-0x0000000004C4A000-memory.dmpFilesize
40KB
-
memory/4288-139-0x0000000006100000-0x0000000006166000-memory.dmpFilesize
408KB
-
memory/4288-140-0x0000000006740000-0x000000000675E000-memory.dmpFilesize
120KB
-
memory/4288-143-0x0000000008130000-0x00000000087AA000-memory.dmpFilesize
6.5MB
-
memory/4288-142-0x0000000007A30000-0x0000000007AA6000-memory.dmpFilesize
472KB
-
memory/4288-141-0x0000000006C90000-0x0000000006CD4000-memory.dmpFilesize
272KB
-
memory/4288-134-0x0000000000000000-mapping.dmp
-
memory/4288-135-0x0000000005150000-0x0000000005186000-memory.dmpFilesize
216KB
-
memory/4288-144-0x0000000007AD0000-0x0000000007AEA000-memory.dmpFilesize
104KB
-
memory/4288-136-0x0000000005860000-0x0000000005E88000-memory.dmpFilesize
6.2MB
-
memory/4288-137-0x0000000005EC0000-0x0000000005EE2000-memory.dmpFilesize
136KB
-
memory/4288-138-0x0000000005F60000-0x0000000005FC6000-memory.dmpFilesize
408KB
-
memory/4764-156-0x0000000006B20000-0x0000000006B70000-memory.dmpFilesize
320KB
-
memory/4764-155-0x0000000005790000-0x000000000582C000-memory.dmpFilesize
624KB
-
memory/4764-154-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4764-152-0x0000000000000000-mapping.dmp