Analysis
-
max time kernel
90s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2022 19:51
Static task
static1
Behavioral task
behavioral1
Sample
D6GEVBNNH11111.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
D6GEVBNNH11111.exe
Resource
win10v2004-20220721-en
General
-
Target
D6GEVBNNH11111.exe
-
Size
625KB
-
MD5
9cef8265c679bafb06f885678ceab7bd
-
SHA1
ac7faaa7e8439951eaafd8e02007f33a555cd01b
-
SHA256
18f7c9fcf55206644996038b2908aa3871e3ea9affa4c6d62a7460f5b95cca90
-
SHA512
ab176b5348a6a69752eb9e47e2ed11f5130a02104f38932f6f88058bed797e0ab8ffabe665c353ba174788cf60d3114961554ce41bef850c4161cc9316451533
Malware Config
Extracted
Protocol: smtp- Host:
multimetals.cfd - Port:
587 - Username:
logs@multimetals.cfd - Password:
logs@multimetals.cfd
Extracted
agenttesla
Protocol: smtp- Host:
multimetals.cfd - Port:
587 - Username:
application/x-www-form-urlencoded - Password:
logs@multimetals.cfd - Email To:
asset@multimetals.cfd
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
D6GEVBNNH11111.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation D6GEVBNNH11111.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
InstallUtil.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Acrobat = "C:\\Users\\Admin\\AppData\\Roaming\\Acrobat\\Acrobat.exe" InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
geater.exedescription pid process target process PID 4668 set thread context of 2552 4668 geater.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
D6GEVBNNH11111.exegeater.exeInstallUtil.exepid process 2996 D6GEVBNNH11111.exe 4668 geater.exe 4668 geater.exe 2552 InstallUtil.exe 2552 InstallUtil.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
D6GEVBNNH11111.exepid process 2996 D6GEVBNNH11111.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
D6GEVBNNH11111.exegeater.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 2996 D6GEVBNNH11111.exe Token: SeDebugPrivilege 4668 geater.exe Token: SeDebugPrivilege 2552 InstallUtil.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
D6GEVBNNH11111.exegeater.exedescription pid process target process PID 2996 wrote to memory of 4668 2996 D6GEVBNNH11111.exe geater.exe PID 2996 wrote to memory of 4668 2996 D6GEVBNNH11111.exe geater.exe PID 2996 wrote to memory of 4668 2996 D6GEVBNNH11111.exe geater.exe PID 4668 wrote to memory of 2552 4668 geater.exe InstallUtil.exe PID 4668 wrote to memory of 2552 4668 geater.exe InstallUtil.exe PID 4668 wrote to memory of 2552 4668 geater.exe InstallUtil.exe PID 4668 wrote to memory of 2552 4668 geater.exe InstallUtil.exe PID 4668 wrote to memory of 2552 4668 geater.exe InstallUtil.exe PID 4668 wrote to memory of 2552 4668 geater.exe InstallUtil.exe PID 4668 wrote to memory of 2552 4668 geater.exe InstallUtil.exe PID 4668 wrote to memory of 2552 4668 geater.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\D6GEVBNNH11111.exe"C:\Users\Admin\AppData\Local\Temp\D6GEVBNNH11111.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\geater.exe"C:\Users\Admin\AppData\Local\Temp\geater.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2552-137-0x0000000000000000-mapping.dmp
-
memory/2552-138-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2552-139-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/2552-140-0x00000000063B0000-0x0000000006400000-memory.dmpFilesize
320KB
-
memory/2996-130-0x00000000009A0000-0x0000000000A42000-memory.dmpFilesize
648KB
-
memory/2996-131-0x00000000050E0000-0x0000000005684000-memory.dmpFilesize
5.6MB
-
memory/2996-132-0x0000000004BD0000-0x0000000004C6C000-memory.dmpFilesize
624KB
-
memory/2996-133-0x000000000B790000-0x000000000B822000-memory.dmpFilesize
584KB
-
memory/2996-134-0x000000000B750000-0x000000000B75A000-memory.dmpFilesize
40KB
-
memory/2996-135-0x000000000DD40000-0x000000000E26C000-memory.dmpFilesize
5.2MB
-
memory/4668-136-0x0000000000000000-mapping.dmp