Analysis
-
max time kernel
174s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 13:34
Static task
static1
Behavioral task
behavioral1
Sample
Komercijalna.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Komercijalna.exe
Resource
win10v2004-20220414-en
General
-
Target
Komercijalna.exe
-
Size
75KB
-
MD5
a345151fb544be3e1df9f07be51063e1
-
SHA1
0d0e194f720298af42a04628290704eb53bf6e96
-
SHA256
d37759d28521bfeb8b4f5de10692edb29c3bbf6a377e8f16aa9309cf5a978571
-
SHA512
0a32c56b637df341761599a27b167e562a5d288136bb964b9298b1dbf3a7147fec59b1509820d96603d6b232a1a442ef6639961e32825cf2ed7d71f0b25792b3
Malware Config
Extracted
Protocol: smtp- Host:
mail.barqaab.com - Port:
587 - Username:
info@barqaab.com - Password:
Great@999@
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:9128
127.0.0.1:9121
23.105.131.196:6606
23.105.131.196:7707
23.105.131.196:8808
23.105.131.196:9128
23.105.131.196:9121
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Extracted
agenttesla
Protocol: smtp- Host:
mail.barqaab.com - Port:
587 - Username:
info@barqaab.com - Password:
Great@999@ - Email To:
contacto@filtrosdys.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
suricata: ET MALWARE AgentTesla Exfil Via SMTP
suricata: ET MALWARE AgentTesla Exfil Via SMTP
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Cfczgztufslbgdobwbfdvbshooter async - copy.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Cfczgztufslbgdobwbfdvbshooter async - copy.exe asyncrat behavioral2/memory/2820-150-0x00000000009F0000-0x0000000000A02000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
Cfczgztufslbgdobwbfdvbshooter async - copy.exepid process 2820 Cfczgztufslbgdobwbfdvbshooter async - copy.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Komercijalna.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation Komercijalna.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Komercijalna.exedescription pid process target process PID 2896 set thread context of 2552 2896 Komercijalna.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
powershell.exepowershell.exeKomercijalna.exeInstallUtil.exepid process 1296 powershell.exe 1296 powershell.exe 1684 powershell.exe 1684 powershell.exe 2896 Komercijalna.exe 2896 Komercijalna.exe 2896 Komercijalna.exe 2896 Komercijalna.exe 2896 Komercijalna.exe 2896 Komercijalna.exe 2552 InstallUtil.exe 2552 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exeKomercijalna.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1296 powershell.exe Token: SeDebugPrivilege 2896 Komercijalna.exe Token: SeDebugPrivilege 1684 powershell.exe Token: SeDebugPrivilege 2552 InstallUtil.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Komercijalna.exedescription pid process target process PID 2896 wrote to memory of 1296 2896 Komercijalna.exe powershell.exe PID 2896 wrote to memory of 1296 2896 Komercijalna.exe powershell.exe PID 2896 wrote to memory of 1296 2896 Komercijalna.exe powershell.exe PID 2896 wrote to memory of 1684 2896 Komercijalna.exe powershell.exe PID 2896 wrote to memory of 1684 2896 Komercijalna.exe powershell.exe PID 2896 wrote to memory of 1684 2896 Komercijalna.exe powershell.exe PID 2896 wrote to memory of 2820 2896 Komercijalna.exe Cfczgztufslbgdobwbfdvbshooter async - copy.exe PID 2896 wrote to memory of 2820 2896 Komercijalna.exe Cfczgztufslbgdobwbfdvbshooter async - copy.exe PID 2896 wrote to memory of 2820 2896 Komercijalna.exe Cfczgztufslbgdobwbfdvbshooter async - copy.exe PID 2896 wrote to memory of 4680 2896 Komercijalna.exe InstallUtil.exe PID 2896 wrote to memory of 4680 2896 Komercijalna.exe InstallUtil.exe PID 2896 wrote to memory of 4680 2896 Komercijalna.exe InstallUtil.exe PID 2896 wrote to memory of 2552 2896 Komercijalna.exe InstallUtil.exe PID 2896 wrote to memory of 2552 2896 Komercijalna.exe InstallUtil.exe PID 2896 wrote to memory of 2552 2896 Komercijalna.exe InstallUtil.exe PID 2896 wrote to memory of 2552 2896 Komercijalna.exe InstallUtil.exe PID 2896 wrote to memory of 2552 2896 Komercijalna.exe InstallUtil.exe PID 2896 wrote to memory of 2552 2896 Komercijalna.exe InstallUtil.exe PID 2896 wrote to memory of 2552 2896 Komercijalna.exe InstallUtil.exe PID 2896 wrote to memory of 2552 2896 Komercijalna.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Komercijalna.exe"C:\Users\Admin\AppData\Local\Temp\Komercijalna.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Cfczgztufslbgdobwbfdvbshooter async - copy.exe"C:\Users\Admin\AppData\Local\Temp\Cfczgztufslbgdobwbfdvbshooter async - copy.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD53337d66209faa998d52d781d0ff2d804
SHA16594b85a70f998f79f43cdf1ca56137997534156
SHA2569b946b062865f68b9f0f43a011d33d7ea0926a3c8f78fb20d9cab6144314e1bd
SHA5128bbd14bd73111f7b55712f5d1e1b727e41db8e6e0c1243ee6809ff32b509e52dec7af34c064151fb5beccd59dda434a3f83abe987c561a25abfbb4cbcf9c7f1f
-
C:\Users\Admin\AppData\Local\Temp\Cfczgztufslbgdobwbfdvbshooter async - copy.exeFilesize
45KB
MD500d5550c2b9acd6da86fd00984d3ab6a
SHA1dc4fa646308ca423d1294853a15bc36afea7ee41
SHA25609bbd1f7b4e4404a20d763084e8c24a56aa99f28aa829cf727ab07dd17ea1962
SHA5122121d95b958624d0b3c3389d283e190096bbc7520e253acce210f9d3d797666e8a3978a6eddc72b31c05dd52e4dff51ac37549f85f188aae39f0c1234e6b8155
-
C:\Users\Admin\AppData\Local\Temp\Cfczgztufslbgdobwbfdvbshooter async - copy.exeFilesize
45KB
MD500d5550c2b9acd6da86fd00984d3ab6a
SHA1dc4fa646308ca423d1294853a15bc36afea7ee41
SHA25609bbd1f7b4e4404a20d763084e8c24a56aa99f28aa829cf727ab07dd17ea1962
SHA5122121d95b958624d0b3c3389d283e190096bbc7520e253acce210f9d3d797666e8a3978a6eddc72b31c05dd52e4dff51ac37549f85f188aae39f0c1234e6b8155
-
memory/1296-136-0x0000000004FF0000-0x0000000005618000-memory.dmpFilesize
6.2MB
-
memory/1296-144-0x0000000007190000-0x00000000071AA000-memory.dmpFilesize
104KB
-
memory/1296-135-0x0000000004840000-0x0000000004876000-memory.dmpFilesize
216KB
-
memory/1296-134-0x0000000000000000-mapping.dmp
-
memory/1296-137-0x0000000004E10000-0x0000000004E32000-memory.dmpFilesize
136KB
-
memory/1296-138-0x0000000004EB0000-0x0000000004F16000-memory.dmpFilesize
408KB
-
memory/1296-139-0x0000000004F20000-0x0000000004F86000-memory.dmpFilesize
408KB
-
memory/1296-140-0x0000000005DF0000-0x0000000005E0E000-memory.dmpFilesize
120KB
-
memory/1296-141-0x0000000006360000-0x00000000063A4000-memory.dmpFilesize
272KB
-
memory/1296-142-0x00000000070F0000-0x0000000007166000-memory.dmpFilesize
472KB
-
memory/1296-143-0x00000000077F0000-0x0000000007E6A000-memory.dmpFilesize
6.5MB
-
memory/1684-145-0x0000000000000000-mapping.dmp
-
memory/2552-152-0x0000000000000000-mapping.dmp
-
memory/2552-153-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2552-154-0x00000000053C0000-0x000000000545C000-memory.dmpFilesize
624KB
-
memory/2552-155-0x0000000006750000-0x00000000067A0000-memory.dmpFilesize
320KB
-
memory/2820-147-0x0000000000000000-mapping.dmp
-
memory/2820-150-0x00000000009F0000-0x0000000000A02000-memory.dmpFilesize
72KB
-
memory/2896-130-0x00000000008D0000-0x00000000008E8000-memory.dmpFilesize
96KB
-
memory/2896-133-0x0000000005270000-0x000000000527A000-memory.dmpFilesize
40KB
-
memory/2896-132-0x00000000052C0000-0x0000000005352000-memory.dmpFilesize
584KB
-
memory/2896-131-0x0000000005950000-0x0000000005EF4000-memory.dmpFilesize
5.6MB
-
memory/4680-151-0x0000000000000000-mapping.dmp