Analysis
-
max time kernel
166s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 07:18
Static task
static1
Behavioral task
behavioral1
Sample
PI.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
PI.exe
Resource
win10v2004-20221111-en
General
-
Target
PI.exe
-
Size
671KB
-
MD5
f98d644ab8f19948187c6189918dcc1c
-
SHA1
99ef151d996ed3f09e66891ae304a2f36299dd39
-
SHA256
3a5e2c67c21dcfb129ce78a036ae4bf136a05493001ad7326c7fe9aab6a444e7
-
SHA512
f2ba2a292e0eff9cc8490c2147293d13183acd0aad66ef58ede5d3720fe37960ca27cc4ef9c7d9327cb0c9256ec1c963e3292bcce889ddbc186aaec500abfe8e
-
SSDEEP
12288:XPuYd+V6b1momPZefcZnhYy8kL2JDiyllunMeZhJITR3oIxWgSaMPuYd+V6b:XPuYd+V6bIomxichF8kL26nLhJITR4Is
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.svcnc.com - Port:
587 - Username:
[email protected] - Password:
Krupashine@6791 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PI.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation PI.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PI.exedescription pid process target process PID 4448 set thread context of 4948 4448 PI.exe PI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exePI.exepid process 532 powershell.exe 4668 powershell.exe 4948 PI.exe 4948 PI.exe 532 powershell.exe 4668 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exePI.exedescription pid process Token: SeDebugPrivilege 4668 powershell.exe Token: SeDebugPrivilege 532 powershell.exe Token: SeDebugPrivilege 4948 PI.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
PI.exedescription pid process target process PID 4448 wrote to memory of 4668 4448 PI.exe powershell.exe PID 4448 wrote to memory of 4668 4448 PI.exe powershell.exe PID 4448 wrote to memory of 4668 4448 PI.exe powershell.exe PID 4448 wrote to memory of 532 4448 PI.exe powershell.exe PID 4448 wrote to memory of 532 4448 PI.exe powershell.exe PID 4448 wrote to memory of 532 4448 PI.exe powershell.exe PID 4448 wrote to memory of 4256 4448 PI.exe schtasks.exe PID 4448 wrote to memory of 4256 4448 PI.exe schtasks.exe PID 4448 wrote to memory of 4256 4448 PI.exe schtasks.exe PID 4448 wrote to memory of 4948 4448 PI.exe PI.exe PID 4448 wrote to memory of 4948 4448 PI.exe PI.exe PID 4448 wrote to memory of 4948 4448 PI.exe PI.exe PID 4448 wrote to memory of 4948 4448 PI.exe PI.exe PID 4448 wrote to memory of 4948 4448 PI.exe PI.exe PID 4448 wrote to memory of 4948 4448 PI.exe PI.exe PID 4448 wrote to memory of 4948 4448 PI.exe PI.exe PID 4448 wrote to memory of 4948 4448 PI.exe PI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PI.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hpuAAGQUj.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hpuAAGQUj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4CED.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4CED.tmpFilesize
1KB
MD558efaba1aceadff4d41268cd4e8ef3d8
SHA1be138e20f615c7f857bab25dcd83d7832d725c04
SHA256403a372c699cd33c89efad91cfda085338d9c2c82521016a730deb889906b257
SHA512cc64b8da3441b1294623df43ab3f3d1dfaa850fbb1b703b286bf84c1e4482a8efa3c70c36a6d205bb6b1f19fad0304b348a7324d1dac09785d8b5aced1bbf4ec
-
memory/532-145-0x0000000004C00000-0x0000000004C22000-memory.dmpFilesize
136KB
-
memory/532-148-0x0000000005C40000-0x0000000005C5E000-memory.dmpFilesize
120KB
-
memory/532-138-0x0000000000000000-mapping.dmp
-
memory/532-147-0x0000000005560000-0x00000000055C6000-memory.dmpFilesize
408KB
-
memory/4256-139-0x0000000000000000-mapping.dmp
-
memory/4448-133-0x0000000005FE0000-0x0000000006584000-memory.dmpFilesize
5.6MB
-
memory/4448-134-0x0000000005AD0000-0x0000000005B62000-memory.dmpFilesize
584KB
-
memory/4448-135-0x0000000005A40000-0x0000000005A4A000-memory.dmpFilesize
40KB
-
memory/4448-136-0x0000000006A00000-0x0000000006A9C000-memory.dmpFilesize
624KB
-
memory/4448-132-0x0000000000FE0000-0x000000000108E000-memory.dmpFilesize
696KB
-
memory/4668-140-0x0000000004EB0000-0x0000000004EE6000-memory.dmpFilesize
216KB
-
memory/4668-142-0x0000000005560000-0x0000000005B88000-memory.dmpFilesize
6.2MB
-
memory/4668-146-0x0000000005B90000-0x0000000005BF6000-memory.dmpFilesize
408KB
-
memory/4668-137-0x0000000000000000-mapping.dmp
-
memory/4948-144-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4948-143-0x0000000000000000-mapping.dmp