Analysis
-
max time kernel
99s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2022 15:53
Static task
static1
Behavioral task
behavioral1
Sample
B35@6B.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
B35@6B.exe
Resource
win10v2004-20220721-en
General
-
Target
B35@6B.exe
-
Size
586KB
-
MD5
6753a24ed2a75dbd488c0a1783f03d05
-
SHA1
70c061619c4ebbbb111923257e76cd3cef5b3618
-
SHA256
a9b46ddb3ed98e2ca5e71253a69f686e1f618f724821eb98b52b812844117f33
-
SHA512
f7ffb706831a980a4fb1a631de7a7e594de3b95f490b869291439c828ed77afce69f168ac5e23b105fca5709d6f07b662a080cdce49dd81fd3db0b938465d588
Malware Config
Extracted
Protocol: smtp- Host:
multimetals.cfd - Port:
587 - Username:
logs@multimetals.cfd - Password:
logs@multimetals.cfd
Extracted
agenttesla
Protocol: smtp- Host:
multimetals.cfd - Port:
587 - Username:
application/x-www-form-urlencoded - Password:
logs@multimetals.cfd - Email To:
asset@multimetals.cfd
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
B35@6B.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation B35@6B.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
InstallUtil.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Acrobat = "C:\\Users\\Admin\\AppData\\Roaming\\Acrobat\\Acrobat.exe" InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
pot.exedescription pid process target process PID 4692 set thread context of 4592 4692 pot.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
B35@6B.exepot.exeInstallUtil.exepid process 4380 B35@6B.exe 4692 pot.exe 4692 pot.exe 4592 InstallUtil.exe 4592 InstallUtil.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
B35@6B.exepid process 4380 B35@6B.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
B35@6B.exepot.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 4380 B35@6B.exe Token: SeDebugPrivilege 4692 pot.exe Token: SeDebugPrivilege 4592 InstallUtil.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
B35@6B.exepot.exedescription pid process target process PID 4380 wrote to memory of 4692 4380 B35@6B.exe pot.exe PID 4380 wrote to memory of 4692 4380 B35@6B.exe pot.exe PID 4380 wrote to memory of 4692 4380 B35@6B.exe pot.exe PID 4692 wrote to memory of 4592 4692 pot.exe InstallUtil.exe PID 4692 wrote to memory of 4592 4692 pot.exe InstallUtil.exe PID 4692 wrote to memory of 4592 4692 pot.exe InstallUtil.exe PID 4692 wrote to memory of 4592 4692 pot.exe InstallUtil.exe PID 4692 wrote to memory of 4592 4692 pot.exe InstallUtil.exe PID 4692 wrote to memory of 4592 4692 pot.exe InstallUtil.exe PID 4692 wrote to memory of 4592 4692 pot.exe InstallUtil.exe PID 4692 wrote to memory of 4592 4692 pot.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\B35@6B.exe"C:\Users\Admin\AppData\Local\Temp\B35@6B.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pot.exe"C:\Users\Admin\AppData\Local\Temp\pot.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4380-130-0x0000000000990000-0x0000000000A28000-memory.dmpFilesize
608KB
-
memory/4380-131-0x00000000053B0000-0x0000000005954000-memory.dmpFilesize
5.6MB
-
memory/4380-132-0x0000000004EA0000-0x0000000004F3C000-memory.dmpFilesize
624KB
-
memory/4380-133-0x000000000BA90000-0x000000000BB22000-memory.dmpFilesize
584KB
-
memory/4380-134-0x000000000BA60000-0x000000000BA6A000-memory.dmpFilesize
40KB
-
memory/4380-135-0x000000000E450000-0x000000000E97C000-memory.dmpFilesize
5.2MB
-
memory/4592-137-0x0000000000000000-mapping.dmp
-
memory/4592-138-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4592-139-0x00000000064E0000-0x0000000006546000-memory.dmpFilesize
408KB
-
memory/4592-140-0x0000000006B20000-0x0000000006B70000-memory.dmpFilesize
320KB
-
memory/4692-136-0x0000000000000000-mapping.dmp