Analysis
-
max time kernel
106s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
30-06-2022 17:08
Static task
static1
Behavioral task
behavioral1
Sample
18d5927d197f41af4d9b16621b0515a6.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
18d5927d197f41af4d9b16621b0515a6.exe
Resource
win10v2004-20220414-en
General
-
Target
18d5927d197f41af4d9b16621b0515a6.exe
-
Size
172KB
-
MD5
18d5927d197f41af4d9b16621b0515a6
-
SHA1
d2f4345de440d781b22f3ecf5b922783b4264bdd
-
SHA256
613113ce85195ad4ee1d48d212424be5719d697429f2cfe422752e056d2236c0
-
SHA512
60dde5e043e91469135829aa1590d7e505644fa22a675a205e5cc40e507b27b06e6fcfcc418b72fc8752a788ce51fd8ee3919fa4534ae94bf889db948b50e24b
Malware Config
Extracted
agenttesla
http://136.144.41.76/bray/inc/a4a9ffb236214a.php
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:1111
62.197.136.167:6606
62.197.136.167:7707
62.197.136.167:8808
62.197.136.167:1111
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
suricata: ET MALWARE AgentTesla Communicating with CnC Server
suricata: ET MALWARE AgentTesla Communicating with CnC Server
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/836-161-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Drops file in Drivers directory 1 IoCs
Processes:
InstallUtil.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts InstallUtil.exe -
Executes dropped EXE 1 IoCs
Processes:
Crstwuze5m.exepid process 4348 Crstwuze5m.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
18d5927d197f41af4d9b16621b0515a6.exeCrstwuze5m.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation 18d5927d197f41af4d9b16621b0515a6.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation Crstwuze5m.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
18d5927d197f41af4d9b16621b0515a6.exeCrstwuze5m.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aeigqqh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tupbtqbro\\Aeigqqh.exe\"" 18d5927d197f41af4d9b16621b0515a6.exe Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aeigqqh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tupbtqbro\\Aeigqqh.exe\"" Crstwuze5m.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
18d5927d197f41af4d9b16621b0515a6.exeCrstwuze5m.exedescription pid process target process PID 2924 set thread context of 3532 2924 18d5927d197f41af4d9b16621b0515a6.exe InstallUtil.exe PID 4348 set thread context of 836 4348 Crstwuze5m.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
powershell.exepowershell.exepowershell.exe18d5927d197f41af4d9b16621b0515a6.exeInstallUtil.exepowershell.exeCrstwuze5m.exepid process 4628 powershell.exe 4628 powershell.exe 3124 powershell.exe 3124 powershell.exe 1324 powershell.exe 2924 18d5927d197f41af4d9b16621b0515a6.exe 2924 18d5927d197f41af4d9b16621b0515a6.exe 1324 powershell.exe 3532 InstallUtil.exe 3532 InstallUtil.exe 2820 powershell.exe 2820 powershell.exe 4348 Crstwuze5m.exe 4348 Crstwuze5m.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
powershell.exe18d5927d197f41af4d9b16621b0515a6.exepowershell.exepowershell.exeInstallUtil.exeCrstwuze5m.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 4628 powershell.exe Token: SeDebugPrivilege 2924 18d5927d197f41af4d9b16621b0515a6.exe Token: SeDebugPrivilege 3124 powershell.exe Token: SeDebugPrivilege 1324 powershell.exe Token: SeDebugPrivilege 3532 InstallUtil.exe Token: SeDebugPrivilege 4348 Crstwuze5m.exe Token: SeDebugPrivilege 2820 powershell.exe Token: SeDebugPrivilege 836 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 3532 InstallUtil.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
18d5927d197f41af4d9b16621b0515a6.exeCrstwuze5m.exedescription pid process target process PID 2924 wrote to memory of 4628 2924 18d5927d197f41af4d9b16621b0515a6.exe powershell.exe PID 2924 wrote to memory of 4628 2924 18d5927d197f41af4d9b16621b0515a6.exe powershell.exe PID 2924 wrote to memory of 4628 2924 18d5927d197f41af4d9b16621b0515a6.exe powershell.exe PID 2924 wrote to memory of 3124 2924 18d5927d197f41af4d9b16621b0515a6.exe powershell.exe PID 2924 wrote to memory of 3124 2924 18d5927d197f41af4d9b16621b0515a6.exe powershell.exe PID 2924 wrote to memory of 3124 2924 18d5927d197f41af4d9b16621b0515a6.exe powershell.exe PID 2924 wrote to memory of 4348 2924 18d5927d197f41af4d9b16621b0515a6.exe Crstwuze5m.exe PID 2924 wrote to memory of 4348 2924 18d5927d197f41af4d9b16621b0515a6.exe Crstwuze5m.exe PID 2924 wrote to memory of 4348 2924 18d5927d197f41af4d9b16621b0515a6.exe Crstwuze5m.exe PID 4348 wrote to memory of 1324 4348 Crstwuze5m.exe powershell.exe PID 4348 wrote to memory of 1324 4348 Crstwuze5m.exe powershell.exe PID 4348 wrote to memory of 1324 4348 Crstwuze5m.exe powershell.exe PID 2924 wrote to memory of 3532 2924 18d5927d197f41af4d9b16621b0515a6.exe InstallUtil.exe PID 2924 wrote to memory of 3532 2924 18d5927d197f41af4d9b16621b0515a6.exe InstallUtil.exe PID 2924 wrote to memory of 3532 2924 18d5927d197f41af4d9b16621b0515a6.exe InstallUtil.exe PID 2924 wrote to memory of 3532 2924 18d5927d197f41af4d9b16621b0515a6.exe InstallUtil.exe PID 2924 wrote to memory of 3532 2924 18d5927d197f41af4d9b16621b0515a6.exe InstallUtil.exe PID 2924 wrote to memory of 3532 2924 18d5927d197f41af4d9b16621b0515a6.exe InstallUtil.exe PID 2924 wrote to memory of 3532 2924 18d5927d197f41af4d9b16621b0515a6.exe InstallUtil.exe PID 2924 wrote to memory of 3532 2924 18d5927d197f41af4d9b16621b0515a6.exe InstallUtil.exe PID 4348 wrote to memory of 2820 4348 Crstwuze5m.exe powershell.exe PID 4348 wrote to memory of 2820 4348 Crstwuze5m.exe powershell.exe PID 4348 wrote to memory of 2820 4348 Crstwuze5m.exe powershell.exe PID 4348 wrote to memory of 836 4348 Crstwuze5m.exe InstallUtil.exe PID 4348 wrote to memory of 836 4348 Crstwuze5m.exe InstallUtil.exe PID 4348 wrote to memory of 836 4348 Crstwuze5m.exe InstallUtil.exe PID 4348 wrote to memory of 836 4348 Crstwuze5m.exe InstallUtil.exe PID 4348 wrote to memory of 836 4348 Crstwuze5m.exe InstallUtil.exe PID 4348 wrote to memory of 836 4348 Crstwuze5m.exe InstallUtil.exe PID 4348 wrote to memory of 836 4348 Crstwuze5m.exe InstallUtil.exe PID 4348 wrote to memory of 836 4348 Crstwuze5m.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18d5927d197f41af4d9b16621b0515a6.exe"C:\Users\Admin\AppData\Local\Temp\18d5927d197f41af4d9b16621b0515a6.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Crstwuze5m.exe"C:\Users\Admin\AppData\Local\Temp\Crstwuze5m.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD53337d66209faa998d52d781d0ff2d804
SHA16594b85a70f998f79f43cdf1ca56137997534156
SHA2569b946b062865f68b9f0f43a011d33d7ea0926a3c8f78fb20d9cab6144314e1bd
SHA5128bbd14bd73111f7b55712f5d1e1b727e41db8e6e0c1243ee6809ff32b509e52dec7af34c064151fb5beccd59dda434a3f83abe987c561a25abfbb4cbcf9c7f1f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD54a76ff2cb0221e6f386934409b4081f9
SHA1641753885fe1f46c609a3291fce3ff3979d83469
SHA2566a7b53fe72bc2081c0bf0633c241097256871865dd7ea0b0d10e842ea575fb9c
SHA5126caef5a5aac18b6a7e8c020e2692c968eaf433000b0153941a26f2223b842b8305ab1d5fc233435aef47e79cdb237fd3584e3bd3bb1f5bd66c8286f91ba8e79b
-
C:\Users\Admin\AppData\Local\Temp\Crstwuze5m.exeFilesize
172KB
MD5982f97ccf89f9d50dbc5d152c7139a50
SHA10ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1
-
C:\Users\Admin\AppData\Local\Temp\Crstwuze5m.exeFilesize
172KB
MD5982f97ccf89f9d50dbc5d152c7139a50
SHA10ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1
-
C:\Users\Admin\AppData\Roaming\Tupbtqbro\Aeigqqh.exeFilesize
172KB
MD5982f97ccf89f9d50dbc5d152c7139a50
SHA10ba6c448dd8566a1196e642ef1d834d55bf6e3e6
SHA256f41360c7779e6656ec89fdfa40ae58b619d80dd27286802a9e902ab9dde19152
SHA512c51127261b13e135e183c779c2bc10b5f43a2e27ccfd902829abc215beddd2070cf3739ac810201ae4eaf98dc9afab9b5e6923e97b1ca7bd0c7e661706c08fd1
-
memory/836-161-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/836-160-0x0000000000000000-mapping.dmp
-
memory/1324-150-0x0000000000000000-mapping.dmp
-
memory/2820-157-0x0000000000000000-mapping.dmp
-
memory/2924-133-0x0000000004AB0000-0x0000000004ABA000-memory.dmpFilesize
40KB
-
memory/2924-130-0x00000000000F0000-0x0000000000120000-memory.dmpFilesize
192KB
-
memory/2924-132-0x0000000004B10000-0x0000000004BA2000-memory.dmpFilesize
584KB
-
memory/2924-131-0x00000000050C0000-0x0000000005664000-memory.dmpFilesize
5.6MB
-
memory/3124-145-0x0000000000000000-mapping.dmp
-
memory/3532-156-0x0000000006880000-0x00000000068D0000-memory.dmpFilesize
320KB
-
memory/3532-154-0x00000000055C0000-0x000000000565C000-memory.dmpFilesize
624KB
-
memory/3532-153-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3532-152-0x0000000000000000-mapping.dmp
-
memory/4348-146-0x0000000000000000-mapping.dmp
-
memory/4348-149-0x0000000000E10000-0x0000000000E40000-memory.dmpFilesize
192KB
-
memory/4628-144-0x0000000007CE0000-0x0000000007CFA000-memory.dmpFilesize
104KB
-
memory/4628-143-0x0000000008340000-0x00000000089BA000-memory.dmpFilesize
6.5MB
-
memory/4628-142-0x0000000007C40000-0x0000000007CB6000-memory.dmpFilesize
472KB
-
memory/4628-141-0x0000000006ED0000-0x0000000006F14000-memory.dmpFilesize
272KB
-
memory/4628-140-0x00000000068C0000-0x00000000068DE000-memory.dmpFilesize
120KB
-
memory/4628-139-0x0000000006310000-0x0000000006376000-memory.dmpFilesize
408KB
-
memory/4628-138-0x0000000005A60000-0x0000000005AC6000-memory.dmpFilesize
408KB
-
memory/4628-137-0x0000000005880000-0x00000000058A2000-memory.dmpFilesize
136KB
-
memory/4628-136-0x0000000005CE0000-0x0000000006308000-memory.dmpFilesize
6.2MB
-
memory/4628-135-0x0000000002FF0000-0x0000000003026000-memory.dmpFilesize
216KB
-
memory/4628-134-0x0000000000000000-mapping.dmp