Analysis
-
max time kernel
188s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 21:18
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER # 12076038 & 12076022.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
PURCHASE ORDER # 12076038 & 12076022.exe
Resource
win10v2004-20221111-en
General
-
Target
PURCHASE ORDER # 12076038 & 12076022.exe
-
Size
897KB
-
MD5
152c62372d3ea07d023e1e187766fd4b
-
SHA1
32b630bc22b63d7eee42851175ebe43a13a92c15
-
SHA256
b3e12ecdee9eacc7354a7d43ccd3ebe7e6db207e93f73b7a847ff4bee9f27f86
-
SHA512
cde084b3ad2e0e7068b4e48d7a58f1173d17bd297a95f3c4af7ee104a80e3d9189d93877f044d652de42f13d6e6c446be97fc2c74d4ae857e93a10f84c68dce7
-
SSDEEP
24576:A7mvLPt69/L1tmzf5LzjG1Vq5p73+KXGUInp:Di/L1t8F61VqP3+KC
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.dmstech.in - Port:
587 - Username:
sanjeev@dmstech.in - Password:
0]6F9Az.pqfd - Email To:
zakirrome@ostdubai.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PURCHASE ORDER # 12076038 & 12076022.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation PURCHASE ORDER # 12076038 & 12076022.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PURCHASE ORDER # 12076038 & 12076022.exedescription pid process target process PID 1892 set thread context of 3664 1892 PURCHASE ORDER # 12076038 & 12076022.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 3664 RegSvcs.exe 3664 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 3664 RegSvcs.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
PURCHASE ORDER # 12076038 & 12076022.exedescription pid process target process PID 1892 wrote to memory of 4768 1892 PURCHASE ORDER # 12076038 & 12076022.exe schtasks.exe PID 1892 wrote to memory of 4768 1892 PURCHASE ORDER # 12076038 & 12076022.exe schtasks.exe PID 1892 wrote to memory of 4768 1892 PURCHASE ORDER # 12076038 & 12076022.exe schtasks.exe PID 1892 wrote to memory of 3664 1892 PURCHASE ORDER # 12076038 & 12076022.exe RegSvcs.exe PID 1892 wrote to memory of 3664 1892 PURCHASE ORDER # 12076038 & 12076022.exe RegSvcs.exe PID 1892 wrote to memory of 3664 1892 PURCHASE ORDER # 12076038 & 12076022.exe RegSvcs.exe PID 1892 wrote to memory of 3664 1892 PURCHASE ORDER # 12076038 & 12076022.exe RegSvcs.exe PID 1892 wrote to memory of 3664 1892 PURCHASE ORDER # 12076038 & 12076022.exe RegSvcs.exe PID 1892 wrote to memory of 3664 1892 PURCHASE ORDER # 12076038 & 12076022.exe RegSvcs.exe PID 1892 wrote to memory of 3664 1892 PURCHASE ORDER # 12076038 & 12076022.exe RegSvcs.exe PID 1892 wrote to memory of 3664 1892 PURCHASE ORDER # 12076038 & 12076022.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER # 12076038 & 12076022.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER # 12076038 & 12076022.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WytzFSULZWRc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC128.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC128.tmpFilesize
1KB
MD56d4d99a8c12bcaa9e2a78fee1a798d9b
SHA1e509268ceb0e0660a10b2c4458c08fba51ba323b
SHA256e43e548d8b94c16b19da86232f92fe71e023f6ea6c9c40c3261d07a4db7d58bc
SHA5122ef5e6af0faa28d0f2b8c8a4c6015ec266acb53608d44e1c8664ea681eb6a2a5c1eb6226fc76ec103dca9952b12a953dfc16688e49c7750f6374d039bba20d86
-
memory/1892-132-0x00000000009C0000-0x0000000000AA6000-memory.dmpFilesize
920KB
-
memory/1892-133-0x0000000005B20000-0x00000000060C4000-memory.dmpFilesize
5.6MB
-
memory/1892-134-0x0000000005470000-0x0000000005502000-memory.dmpFilesize
584KB
-
memory/1892-135-0x0000000005570000-0x000000000560C000-memory.dmpFilesize
624KB
-
memory/1892-136-0x0000000005450000-0x000000000545A000-memory.dmpFilesize
40KB
-
memory/3664-139-0x0000000000000000-mapping.dmp
-
memory/3664-140-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3664-141-0x0000000005E30000-0x0000000005E96000-memory.dmpFilesize
408KB
-
memory/4768-137-0x0000000000000000-mapping.dmp