Analysis
-
max time kernel
78s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 15:53
Static task
static1
Behavioral task
behavioral1
Sample
B35@6B.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
B35@6B.exe
Resource
win10v2004-20220721-en
General
-
Target
B35@6B.exe
-
Size
586KB
-
MD5
6753a24ed2a75dbd488c0a1783f03d05
-
SHA1
70c061619c4ebbbb111923257e76cd3cef5b3618
-
SHA256
a9b46ddb3ed98e2ca5e71253a69f686e1f618f724821eb98b52b812844117f33
-
SHA512
f7ffb706831a980a4fb1a631de7a7e594de3b95f490b869291439c828ed77afce69f168ac5e23b105fca5709d6f07b662a080cdce49dd81fd3db0b938465d588
Malware Config
Extracted
Protocol: smtp- Host:
multimetals.cfd - Port:
587 - Username:
logs@multimetals.cfd - Password:
logs@multimetals.cfd
Extracted
agenttesla
Protocol: smtp- Host:
multimetals.cfd - Port:
587 - Username:
application/x-www-form-urlencoded - Password:
logs@multimetals.cfd - Email To:
asset@multimetals.cfd
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
InstallUtil.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\Acrobat = "C:\\Users\\Admin\\AppData\\Roaming\\Acrobat\\Acrobat.exe" InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
pot.exedescription pid process target process PID 2032 set thread context of 1468 2032 pot.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
B35@6B.exepot.exeInstallUtil.exepid process 1480 B35@6B.exe 2032 pot.exe 2032 pot.exe 1468 InstallUtil.exe 1468 InstallUtil.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
B35@6B.exepid process 1480 B35@6B.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
B35@6B.exepot.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1480 B35@6B.exe Token: SeDebugPrivilege 2032 pot.exe Token: SeDebugPrivilege 1468 InstallUtil.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
B35@6B.exepot.exedescription pid process target process PID 1480 wrote to memory of 2032 1480 B35@6B.exe pot.exe PID 1480 wrote to memory of 2032 1480 B35@6B.exe pot.exe PID 1480 wrote to memory of 2032 1480 B35@6B.exe pot.exe PID 1480 wrote to memory of 2032 1480 B35@6B.exe pot.exe PID 2032 wrote to memory of 1468 2032 pot.exe InstallUtil.exe PID 2032 wrote to memory of 1468 2032 pot.exe InstallUtil.exe PID 2032 wrote to memory of 1468 2032 pot.exe InstallUtil.exe PID 2032 wrote to memory of 1468 2032 pot.exe InstallUtil.exe PID 2032 wrote to memory of 1468 2032 pot.exe InstallUtil.exe PID 2032 wrote to memory of 1468 2032 pot.exe InstallUtil.exe PID 2032 wrote to memory of 1468 2032 pot.exe InstallUtil.exe PID 2032 wrote to memory of 1468 2032 pot.exe InstallUtil.exe PID 2032 wrote to memory of 1468 2032 pot.exe InstallUtil.exe PID 2032 wrote to memory of 1468 2032 pot.exe InstallUtil.exe PID 2032 wrote to memory of 1468 2032 pot.exe InstallUtil.exe PID 2032 wrote to memory of 1468 2032 pot.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\B35@6B.exe"C:\Users\Admin\AppData\Local\Temp\B35@6B.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pot.exe"C:\Users\Admin\AppData\Local\Temp\pot.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1468-63-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1468-67-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1468-68-0x0000000000435D3E-mapping.dmp
-
memory/1468-70-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1468-72-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1468-62-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1468-66-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1468-65-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1480-57-0x0000000000880000-0x0000000000896000-memory.dmpFilesize
88KB
-
memory/1480-54-0x00000000008A0000-0x0000000000938000-memory.dmpFilesize
608KB
-
memory/1480-56-0x0000000000610000-0x000000000063E000-memory.dmpFilesize
184KB
-
memory/1480-55-0x00000000754F1000-0x00000000754F3000-memory.dmpFilesize
8KB
-
memory/2032-61-0x0000000000890000-0x0000000000896000-memory.dmpFilesize
24KB
-
memory/2032-60-0x0000000002060000-0x000000000207A000-memory.dmpFilesize
104KB
-
memory/2032-58-0x0000000000000000-mapping.dmp