Analysis

  • max time kernel
    63s
  • max time network
    78s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-03-2023 12:50

General

  • Target

    qFbGYuKhG1.exe

  • Size

    647KB

  • MD5

    4f34b0b75d7b9ebf3fbd77915cba976f

  • SHA1

    6b8a77a3a2c4a24c8ad7837fbf4c36e822953345

  • SHA256

    7333b7b77d906d10a63058e19f45e6cacd7c0295b229910cf30e5449085b365f

  • SHA512

    c378d935732dd002d850e207a74b7927924c26152e06250c9a02aca4c1e550953d9fd26d7d52566d7d51792a58177346eb2a3af7be2f737f06af2db259682ba3

  • SSDEEP

    12288:MQw8m/eoBcBWYwywwpyuTdHEnyzW8M1s9d8fYf9/Ksq/KsI/Ksp:qNBcBWYYwD+KW8HkMtio5

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.kumbarasigorta.com
  • Port:
    587
  • Username:
    ceren@kumbarasigorta.com
  • Password:
    Ceren1234.
  • Email To:
    jodyfuller356@gmail.com

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\qFbGYuKhG1.exe
    "C:\Users\Admin\AppData\Local\Temp\qFbGYuKhG1.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4436
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4872
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
        3⤵
        • Creates scheduled task(s)
        PID:4780
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB098.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4040
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:1924
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4636
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
          4⤵
            PID:4344
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
            4⤵
              PID:4304
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
              4⤵
                PID:4584
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
                4⤵
                  PID:1356
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
                  4⤵
                    PID:2252
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
                    4⤵
                      PID:1988
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
                      4⤵
                        PID:4740
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
                        4⤵
                          PID:1420
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
                          4⤵
                            PID:2748
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
                            4⤵
                              PID:3244
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
                              4⤵
                                PID:4464
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
                                4⤵
                                  PID:3108
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
                                  4⤵
                                  • Accesses Microsoft Outlook profiles
                                  • Suspicious use of AdjustPrivilegeToken
                                  • outlook_office_path
                                  • outlook_win_path
                                  PID:2616

                          Network

                          MITRE ATT&CK Matrix ATT&CK v6

                          Execution

                          Scheduled Task

                          1
                          T1053

                          Persistence

                          Registry Run Keys / Startup Folder

                          1
                          T1060

                          Scheduled Task

                          1
                          T1053

                          Privilege Escalation

                          Scheduled Task

                          1
                          T1053

                          Defense Evasion

                          Modify Registry

                          1
                          T1112

                          Discovery

                          Query Registry

                          2
                          T1012

                          System Information Discovery

                          2
                          T1082

                          Collection

                          Email Collection

                          1
                          T1114

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\tmpB098.tmp.bat
                            Filesize

                            151B

                            MD5

                            24910e0984352cdd0a504fdbd7fb6260

                            SHA1

                            3786bccffa094d613cd45c7d0e52845be6db3c54

                            SHA256

                            a0b0eac72f12a108a54af40cd0ca3db696fd76987b68c3beb8087120ff541ee5

                            SHA512

                            754905a490a1d0f0685e343cb51e256871d46732ea9e38b71886074206e549f33d8eaa40351834e5830542cfd85d5c093bb63db2a8d78fc8bdc093d2c0ee7638

                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                            Filesize

                            647KB

                            MD5

                            4f34b0b75d7b9ebf3fbd77915cba976f

                            SHA1

                            6b8a77a3a2c4a24c8ad7837fbf4c36e822953345

                            SHA256

                            7333b7b77d906d10a63058e19f45e6cacd7c0295b229910cf30e5449085b365f

                            SHA512

                            c378d935732dd002d850e207a74b7927924c26152e06250c9a02aca4c1e550953d9fd26d7d52566d7d51792a58177346eb2a3af7be2f737f06af2db259682ba3

                          • C:\Users\Admin\AppData\Roaming\svchost.exe
                            Filesize

                            647KB

                            MD5

                            4f34b0b75d7b9ebf3fbd77915cba976f

                            SHA1

                            6b8a77a3a2c4a24c8ad7837fbf4c36e822953345

                            SHA256

                            7333b7b77d906d10a63058e19f45e6cacd7c0295b229910cf30e5449085b365f

                            SHA512

                            c378d935732dd002d850e207a74b7927924c26152e06250c9a02aca4c1e550953d9fd26d7d52566d7d51792a58177346eb2a3af7be2f737f06af2db259682ba3

                          • memory/2616-147-0x0000000005520000-0x0000000005AC4000-memory.dmp
                            Filesize

                            5.6MB

                          • memory/2616-145-0x0000000000400000-0x0000000000430000-memory.dmp
                            Filesize

                            192KB

                          • memory/2616-148-0x0000000004EE0000-0x0000000004F46000-memory.dmp
                            Filesize

                            408KB

                          • memory/2616-149-0x0000000004ED0000-0x0000000004EE0000-memory.dmp
                            Filesize

                            64KB

                          • memory/2616-150-0x00000000068D0000-0x0000000006962000-memory.dmp
                            Filesize

                            584KB

                          • memory/2616-151-0x00000000068A0000-0x00000000068AA000-memory.dmp
                            Filesize

                            40KB

                          • memory/2616-152-0x0000000006AC0000-0x0000000006B10000-memory.dmp
                            Filesize

                            320KB

                          • memory/2616-153-0x0000000006CF0000-0x0000000006EB2000-memory.dmp
                            Filesize

                            1.8MB

                          • memory/2616-154-0x0000000004ED0000-0x0000000004EE0000-memory.dmp
                            Filesize

                            64KB

                          • memory/4436-136-0x0000017ECD330000-0x0000017ECD34E000-memory.dmp
                            Filesize

                            120KB

                          • memory/4436-135-0x0000017EE75A0000-0x0000017EE75B0000-memory.dmp
                            Filesize

                            64KB

                          • memory/4436-134-0x0000017ECEBC0000-0x0000017ECEC36000-memory.dmp
                            Filesize

                            472KB

                          • memory/4436-133-0x0000017ECCF20000-0x0000017ECCFC4000-memory.dmp
                            Filesize

                            656KB