Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-03-2023 13:09

General

  • Target

    TT Copy.exe

  • Size

    678KB

  • MD5

    49b64e415d7d80099fe079b57879e930

  • SHA1

    202495e27168431afd0ce4e57eeca037acd784fd

  • SHA256

    5ee727653b9e6ded021959d91650e3d23c1586b14ed1d22d84c8b3cd5f7e634a

  • SHA512

    72479984aaa3b97c701bd97f5ceba2de9bc4fce17b95cfbe27719dd44569a4fdd8d3771a367941370abd4fd9bd7d1008d24c278f72ed827bc929406508ad7924

  • SSDEEP

    12288:+eJ/sIU9Thtw2th1kfQe4fiGL0c4dwuS3iQRpS2Z5RzG1edBSj81tVimOMt+E:SHwqh1kIev40c43AiQ22zRzG8dA8imX

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TT Copy.exe
    "C:\Users\Admin\AppData\Local\Temp\TT Copy.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YmqxAO.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2984
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YmqxAO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp38E2.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:5068
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:400

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Email Collection

1
T1114

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0hhfoqje.5ck.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmp38E2.tmp
    Filesize

    1KB

    MD5

    89d73a9645720d637545c57decc276d1

    SHA1

    d9401f98c2478d33d93f30cc1b02269e972fec0d

    SHA256

    a66f8cd4de6b2eca4d0540dbd07f6d9e81a78a7138fceae7699e1feea2a687c9

    SHA512

    6d9061ec5ebbe38c1cd185de81ea279d2bb6af45691f89240ad0bb401a388f4a20eea355a9d021c66d550b765f3c82e3600a84bec7cfd0ba9812acc266acab23

  • memory/400-196-0x0000000005890000-0x00000000058A0000-memory.dmp
    Filesize

    64KB

  • memory/400-168-0x0000000005890000-0x00000000058A0000-memory.dmp
    Filesize

    64KB

  • memory/400-155-0x00000000057A0000-0x0000000005806000-memory.dmp
    Filesize

    408KB

  • memory/400-184-0x0000000006F00000-0x0000000006F0A000-memory.dmp
    Filesize

    40KB

  • memory/400-153-0x0000000000400000-0x0000000000430000-memory.dmp
    Filesize

    192KB

  • memory/400-189-0x0000000007150000-0x00000000071A0000-memory.dmp
    Filesize

    320KB

  • memory/400-190-0x0000000007370000-0x0000000007532000-memory.dmp
    Filesize

    1.8MB

  • memory/2188-138-0x00000000052A0000-0x00000000052D8000-memory.dmp
    Filesize

    224KB

  • memory/2188-143-0x0000000004E80000-0x0000000004E90000-memory.dmp
    Filesize

    64KB

  • memory/2188-144-0x00000000091C0000-0x000000000925C000-memory.dmp
    Filesize

    624KB

  • memory/2188-142-0x0000000004E80000-0x0000000004E90000-memory.dmp
    Filesize

    64KB

  • memory/2188-141-0x0000000004E80000-0x0000000004E90000-memory.dmp
    Filesize

    64KB

  • memory/2188-140-0x0000000005AC0000-0x0000000005C66000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-139-0x0000000004FB0000-0x0000000004FBE000-memory.dmp
    Filesize

    56KB

  • memory/2188-137-0x0000000004FA0000-0x0000000004FA8000-memory.dmp
    Filesize

    32KB

  • memory/2188-136-0x0000000005000000-0x0000000005092000-memory.dmp
    Filesize

    584KB

  • memory/2188-135-0x0000000004E80000-0x0000000004E90000-memory.dmp
    Filesize

    64KB

  • memory/2188-134-0x0000000005510000-0x0000000005AB4000-memory.dmp
    Filesize

    5.6MB

  • memory/2188-133-0x00000000003B0000-0x000000000045E000-memory.dmp
    Filesize

    696KB

  • memory/2984-157-0x0000000005980000-0x00000000059E6000-memory.dmp
    Filesize

    408KB

  • memory/2984-156-0x0000000005760000-0x0000000005782000-memory.dmp
    Filesize

    136KB

  • memory/2984-169-0x0000000006820000-0x000000000683E000-memory.dmp
    Filesize

    120KB

  • memory/2984-171-0x0000000006DD0000-0x0000000006E02000-memory.dmp
    Filesize

    200KB

  • memory/2984-172-0x000000007F150000-0x000000007F160000-memory.dmp
    Filesize

    64KB

  • memory/2984-170-0x0000000005630000-0x0000000005640000-memory.dmp
    Filesize

    64KB

  • memory/2984-173-0x0000000074CD0000-0x0000000074D1C000-memory.dmp
    Filesize

    304KB

  • memory/2984-183-0x0000000006DB0000-0x0000000006DCE000-memory.dmp
    Filesize

    120KB

  • memory/2984-154-0x0000000005C70000-0x0000000006298000-memory.dmp
    Filesize

    6.2MB

  • memory/2984-185-0x0000000008260000-0x00000000088DA000-memory.dmp
    Filesize

    6.5MB

  • memory/2984-186-0x0000000007920000-0x000000000793A000-memory.dmp
    Filesize

    104KB

  • memory/2984-187-0x0000000007990000-0x000000000799A000-memory.dmp
    Filesize

    40KB

  • memory/2984-188-0x0000000007DC0000-0x0000000007E56000-memory.dmp
    Filesize

    600KB

  • memory/2984-151-0x0000000005630000-0x0000000005640000-memory.dmp
    Filesize

    64KB

  • memory/2984-150-0x0000000005630000-0x0000000005640000-memory.dmp
    Filesize

    64KB

  • memory/2984-191-0x0000000007D60000-0x0000000007D6E000-memory.dmp
    Filesize

    56KB

  • memory/2984-192-0x0000000007E80000-0x0000000007E9A000-memory.dmp
    Filesize

    104KB

  • memory/2984-193-0x0000000007DB0000-0x0000000007DB8000-memory.dmp
    Filesize

    32KB

  • memory/2984-149-0x0000000002EE0000-0x0000000002F16000-memory.dmp
    Filesize

    216KB