Analysis
-
max time kernel
112s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 14:31
Static task
static1
Behavioral task
behavioral1
Sample
Quote 8103639.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Quote 8103639.exe
Resource
win10v2004-20220901-en
General
-
Target
Quote 8103639.exe
-
Size
302KB
-
MD5
0ac349c67a718638cfb1fe2f70d43a90
-
SHA1
fc19b79c0090de13ec2632901b2d15f9f7d0b746
-
SHA256
0dd53c57c72aea305d1b83fa26283f21caaa5f8263f41d84a43884fb2eb62ce3
-
SHA512
b9c5c3e29b4ccb07ee52f3663aeac7a153c5ff0e0676d443fad612447fc1633d875ea4cb11e317e7204460c37bc8cc09d6027d2a6ee1846a8d8a1875e91d71a6
-
SSDEEP
6144:QBn1jdkWkyxoR5LHNhYH25r9L19EeuZrp+ZRAR/r2E2XhTPldwkBdka7RuS:gCWkD3zYW5N1eem+v6d2xTPhjVT
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE 2 IoCs
Processes:
gtpukenup.exegtpukenup.exepid process 3804 gtpukenup.exe 2248 gtpukenup.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
gtpukenup.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 gtpukenup.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 gtpukenup.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 gtpukenup.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
gtpukenup.exegtpukenup.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ltrd = "C:\\Users\\Admin\\AppData\\Roaming\\xive\\ghbgbiyrmoiq.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\gtpukenup.exe\" C:\\Users\\Admin\\AppData\\Loca" gtpukenup.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\My App = "C:\\Users\\Admin\\AppData\\Roaming\\My App\\My App.exe" gtpukenup.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 15 api.ipify.org 16 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
gtpukenup.exedescription pid process target process PID 3804 set thread context of 2248 3804 gtpukenup.exe gtpukenup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
gtpukenup.exepid process 2248 gtpukenup.exe 2248 gtpukenup.exe 2248 gtpukenup.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
gtpukenup.exepid process 3804 gtpukenup.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
gtpukenup.exedescription pid process Token: SeDebugPrivilege 2248 gtpukenup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
Quote 8103639.exegtpukenup.exedescription pid process target process PID 4640 wrote to memory of 3804 4640 Quote 8103639.exe gtpukenup.exe PID 4640 wrote to memory of 3804 4640 Quote 8103639.exe gtpukenup.exe PID 4640 wrote to memory of 3804 4640 Quote 8103639.exe gtpukenup.exe PID 3804 wrote to memory of 2248 3804 gtpukenup.exe gtpukenup.exe PID 3804 wrote to memory of 2248 3804 gtpukenup.exe gtpukenup.exe PID 3804 wrote to memory of 2248 3804 gtpukenup.exe gtpukenup.exe PID 3804 wrote to memory of 2248 3804 gtpukenup.exe gtpukenup.exe -
outlook_office_path 1 IoCs
Processes:
gtpukenup.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 gtpukenup.exe -
outlook_win_path 1 IoCs
Processes:
gtpukenup.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 gtpukenup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quote 8103639.exe"C:\Users\Admin\AppData\Local\Temp\Quote 8103639.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gtpukenup.exe"C:\Users\Admin\AppData\Local\Temp\gtpukenup.exe" C:\Users\Admin\AppData\Local\Temp\iuxfgcojdaj.jwu2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gtpukenup.exe"C:\Users\Admin\AppData\Local\Temp\gtpukenup.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\gtpukenup.exeFilesize
99KB
MD5ab817969898427b78e7c714f24e4ee72
SHA17a7f40692e722849f588fd6bd1334db5309b6665
SHA256fc0092d464eda6c5f734982af93676587cd49b4767c8c9b6cfe3b205ff78ca61
SHA512ead8aafd928aeb3d59c0b56a85817b54d3656314772705b866922d41876c276ba44a4bbfc3e2bfa750f6f4a22992b0459e0c201a6c5676f377c2613f262ac59f
-
C:\Users\Admin\AppData\Local\Temp\gtpukenup.exeFilesize
99KB
MD5ab817969898427b78e7c714f24e4ee72
SHA17a7f40692e722849f588fd6bd1334db5309b6665
SHA256fc0092d464eda6c5f734982af93676587cd49b4767c8c9b6cfe3b205ff78ca61
SHA512ead8aafd928aeb3d59c0b56a85817b54d3656314772705b866922d41876c276ba44a4bbfc3e2bfa750f6f4a22992b0459e0c201a6c5676f377c2613f262ac59f
-
C:\Users\Admin\AppData\Local\Temp\gtpukenup.exeFilesize
99KB
MD5ab817969898427b78e7c714f24e4ee72
SHA17a7f40692e722849f588fd6bd1334db5309b6665
SHA256fc0092d464eda6c5f734982af93676587cd49b4767c8c9b6cfe3b205ff78ca61
SHA512ead8aafd928aeb3d59c0b56a85817b54d3656314772705b866922d41876c276ba44a4bbfc3e2bfa750f6f4a22992b0459e0c201a6c5676f377c2613f262ac59f
-
C:\Users\Admin\AppData\Local\Temp\iuxfgcojdaj.jwuFilesize
7KB
MD51ffe5ceb1e2b01b208746aac0d44ef55
SHA144ad982f51bf3fbbfca0e20d96f1cbde569b1b91
SHA256e46d4a5f3b280f81b7189c420d8ff662cd5444256228abf4b47ce46e4bc11bdc
SHA512c6adc802088deac1c2d759d9e31fdb8ea780f9c17295c3b5d8c2a35c59f4addbe870a900f1a8ae2f8d20f1a4c0bb9e7af41fdecffc1cd614a39bbccb63a350ab
-
C:\Users\Admin\AppData\Local\Temp\zqipsaipv.tsFilesize
274KB
MD537e33d31316dfdd06118eefc95faaadd
SHA1279b43694e57b9680f408c70ed8924b20fd0a9d8
SHA25628ce9a577716e7d124eb0950086d3b586cf1f7522e28bf17233bf5fbe911f4f1
SHA512c9a31d45eb08c041615210572fe752ab30fbb3f4467e7ed15d80d4a2b0e501f7bf1e960c269aaa14536c9109663c8ddc151cd24cd402202bac1d8e11fcbd3ec7
-
memory/2248-138-0x0000000000000000-mapping.dmp
-
memory/2248-140-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/2248-141-0x0000000005E90000-0x0000000006434000-memory.dmpFilesize
5.6MB
-
memory/2248-142-0x00000000059D0000-0x0000000005A6C000-memory.dmpFilesize
624KB
-
memory/2248-143-0x0000000006920000-0x0000000006986000-memory.dmpFilesize
408KB
-
memory/2248-144-0x00000000071D0000-0x0000000007220000-memory.dmpFilesize
320KB
-
memory/2248-145-0x0000000007300000-0x0000000007392000-memory.dmpFilesize
584KB
-
memory/2248-146-0x0000000007610000-0x000000000761A000-memory.dmpFilesize
40KB
-
memory/3804-133-0x0000000000000000-mapping.dmp