Analysis
-
max time kernel
140s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2022 07:19
Static task
static1
Behavioral task
behavioral1
Sample
REQUIRED ORDER.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
REQUIRED ORDER.exe
Resource
win10v2004-20220812-en
General
-
Target
REQUIRED ORDER.exe
-
Size
7KB
-
MD5
c68e150c213e614b8eed86bec7074a57
-
SHA1
588e888e99e13455a5c65502f6bda6ee55dac129
-
SHA256
e2ee31975055f1a2bb5b4eb478d7d693cc7022fbc36586aa9bd1088fe1a03eee
-
SHA512
fc420f30245e67ac4457466c57c3dbc527503516b82657f5915f9774e7be61cb420bdf0690bc49454214278583e24d81046cd43cdf1f51e100daabc9575e71d3
-
SSDEEP
192:UaCT1T4dytLR0ukYzHhNICgR4ur2FC6o:UaCBttLR0ukyZur2s
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5381304443:AAGHVkAfThlNIr1QK0cvWGNfRmolq65orZw/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
REQUIRED ORDER.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation REQUIRED ORDER.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
REQUIRED ORDER.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 REQUIRED ORDER.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 REQUIRED ORDER.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 REQUIRED ORDER.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
REQUIRED ORDER.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ltwxkm = "\"C:\\Users\\Admin\\AppData\\Roaming\\Kesawxb\\Ltwxkm.exe\"" REQUIRED ORDER.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 38 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
REQUIRED ORDER.exedescription pid process target process PID 2432 set thread context of 2260 2432 REQUIRED ORDER.exe REQUIRED ORDER.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exeREQUIRED ORDER.exepid process 4844 powershell.exe 4844 powershell.exe 2260 REQUIRED ORDER.exe 2260 REQUIRED ORDER.exe 2260 REQUIRED ORDER.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
REQUIRED ORDER.exepowershell.exeREQUIRED ORDER.exedescription pid process Token: SeDebugPrivilege 2432 REQUIRED ORDER.exe Token: SeDebugPrivilege 4844 powershell.exe Token: SeDebugPrivilege 2260 REQUIRED ORDER.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
REQUIRED ORDER.exedescription pid process target process PID 2432 wrote to memory of 4844 2432 REQUIRED ORDER.exe powershell.exe PID 2432 wrote to memory of 4844 2432 REQUIRED ORDER.exe powershell.exe PID 2432 wrote to memory of 4844 2432 REQUIRED ORDER.exe powershell.exe PID 2432 wrote to memory of 2260 2432 REQUIRED ORDER.exe REQUIRED ORDER.exe PID 2432 wrote to memory of 2260 2432 REQUIRED ORDER.exe REQUIRED ORDER.exe PID 2432 wrote to memory of 2260 2432 REQUIRED ORDER.exe REQUIRED ORDER.exe PID 2432 wrote to memory of 2260 2432 REQUIRED ORDER.exe REQUIRED ORDER.exe PID 2432 wrote to memory of 2260 2432 REQUIRED ORDER.exe REQUIRED ORDER.exe PID 2432 wrote to memory of 2260 2432 REQUIRED ORDER.exe REQUIRED ORDER.exe PID 2432 wrote to memory of 2260 2432 REQUIRED ORDER.exe REQUIRED ORDER.exe PID 2432 wrote to memory of 2260 2432 REQUIRED ORDER.exe REQUIRED ORDER.exe -
outlook_office_path 1 IoCs
Processes:
REQUIRED ORDER.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 REQUIRED ORDER.exe -
outlook_win_path 1 IoCs
Processes:
REQUIRED ORDER.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 REQUIRED ORDER.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\REQUIRED ORDER.exe"C:\Users\Admin\AppData\Local\Temp\REQUIRED ORDER.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQA1AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\REQUIRED ORDER.exe"C:\Users\Admin\AppData\Local\Temp\REQUIRED ORDER.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\REQUIRED ORDER.exe.logFilesize
1KB
MD52b3258a61b837343118a3cefd57195d7
SHA194104ed5eec4aa877cb3ba4ef5d0c7d1bc05621b
SHA2569a81c2609ea56372df4bdc169cdd691f469bf9ad81f80bf3b5bc508a665a780c
SHA51200dbcf848a10a1469d94302d7c6cf1aa53c37b1d43790a4423ed8db905ca97835052e1a7f2a390ea5a00cc84e00e4ae1b8efb5bc4b929d942c9b9f59cf22442d
-
memory/2260-144-0x0000000000000000-mapping.dmp
-
memory/2260-149-0x0000000007100000-0x000000000710A000-memory.dmpFilesize
40KB
-
memory/2260-148-0x0000000007110000-0x0000000007160000-memory.dmpFilesize
320KB
-
memory/2260-147-0x00000000057B0000-0x000000000584C000-memory.dmpFilesize
624KB
-
memory/2260-145-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2432-133-0x0000000006CD0000-0x0000000007274000-memory.dmpFilesize
5.6MB
-
memory/2432-135-0x00000000067D0000-0x00000000067F2000-memory.dmpFilesize
136KB
-
memory/2432-134-0x0000000006820000-0x00000000068B2000-memory.dmpFilesize
584KB
-
memory/2432-132-0x0000000000FD0000-0x0000000000FD8000-memory.dmpFilesize
32KB
-
memory/4844-136-0x0000000000000000-mapping.dmp
-
memory/4844-143-0x0000000006280000-0x000000000629A000-memory.dmpFilesize
104KB
-
memory/4844-142-0x00000000076B0000-0x0000000007D2A000-memory.dmpFilesize
6.5MB
-
memory/4844-141-0x0000000005CA0000-0x0000000005CBE000-memory.dmpFilesize
120KB
-
memory/4844-140-0x0000000005680000-0x00000000056E6000-memory.dmpFilesize
408KB
-
memory/4844-139-0x0000000005610000-0x0000000005676000-memory.dmpFilesize
408KB
-
memory/4844-138-0x0000000004F70000-0x0000000005598000-memory.dmpFilesize
6.2MB
-
memory/4844-137-0x0000000002830000-0x0000000002866000-memory.dmpFilesize
216KB