Resubmissions
24/12/2022, 20:34
221224-zcnccsdg6t1024/12/2022, 00:27
221224-arzaqsce911023/12/2022, 23:33
221223-3jva2ace7v10Analysis
- max time kernel
149s - max time network
151s - platform
windows7_x64 - resource
win7-20220901-en - resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system - submitted
24/12/2022, 00:27
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe
Resource
win7-20220901-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
28 signatures
150 seconds
General
- Target SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe
- Size 1.1MB
- Sample221224-arzaqsce91
- SHA256 6f05a91cd30498cf1bc9b2e0058f1e3caa18b401b77d0a83b71a6df845430716
- MD5 ff463709d7e429065e6efeb1456281a5
- SHA1 43821ebc1f3f3e1b7208314747fdf8527263f363
- SHA512 990efaf520e2bfcf2a42b491e67b9266380d966439e132c40ad0eba28ae9ebaf6448bb538128a38e851be6a6660b04451c75138139e1371ac104540564a07dcd
- SSDEEP 12288:SNP57i9RD++rs7j5Dytl7B1ljdOtovwGPVp/n2sS4OIvlxd2UIivOmBgdUYt9flG:Xh7XfPCsS41hbjSCC5Gm6oG+/c
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe - Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys" SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe - Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\887520F186994FFBB6ECD965C1E49874 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe\"" SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org 4 api.ipify.org - Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\taskhost.exe taskmgr.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1348 set thread context of 1464 1348 SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe 30 - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe taskmgr.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1568 powershell.exe 1464 CasPol.exe 1464 CasPol.exe 1464 CasPol.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1028 taskmgr.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1348 SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1348 SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe Token: SeDebugPrivilege 1348 SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe Token: SeLoadDriverPrivilege 1348 SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe Token: SeDebugPrivilege 1568 powershell.exe Token: SeDebugPrivilege 1464 CasPol.exe Token: SeDebugPrivilege 1028 taskmgr.exe Token: SeSecurityPrivilege 1028 taskmgr.exe Token: SeTakeOwnershipPrivilege 1028 taskmgr.exe Token: SeSecurityPrivilege 1028 taskmgr.exe Token: SeTakeOwnershipPrivilege 1028 taskmgr.exe Token: SeSecurityPrivilege 1028 taskmgr.exe Token: SeTakeOwnershipPrivilege 1028 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe 1028 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1464 CasPol.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1348 wrote to memory of 1568 1348 SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe 28 PID 1348 wrote to memory of 1568 1348 SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe 28 PID 1348 wrote to memory of 1568 1348 SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe 28 PID 1348 wrote to memory of 1464 1348 SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe 30 PID 1348 wrote to memory of 1464 1348 SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe 30 PID 1348 wrote to memory of 1464 1348 SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe 30 PID 1348 wrote to memory of 1464 1348 SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe 30 PID 1348 wrote to memory of 1464 1348 SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe 30 PID 1348 wrote to memory of 1464 1348 SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe 30 PID 1348 wrote to memory of 1464 1348 SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe 30 PID 1348 wrote to memory of 1464 1348 SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe 30 PID 1348 wrote to memory of 1464 1348 SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe 30 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe"1⤵
- UAC bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Sets service image path in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1348 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.RATX-gen.30948.8275.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1464
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1028