Analysis
-
max time kernel
62s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30-03-2023 13:11
Static task
static1
Behavioral task
behavioral1
Sample
TT Copy.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
TT Copy.exe
Resource
win10v2004-20230221-en
General
-
Target
TT Copy.exe
-
Size
678KB
-
MD5
49b64e415d7d80099fe079b57879e930
-
SHA1
202495e27168431afd0ce4e57eeca037acd784fd
-
SHA256
5ee727653b9e6ded021959d91650e3d23c1586b14ed1d22d84c8b3cd5f7e634a
-
SHA512
72479984aaa3b97c701bd97f5ceba2de9bc4fce17b95cfbe27719dd44569a4fdd8d3771a367941370abd4fd9bd7d1008d24c278f72ed827bc929406508ad7924
-
SSDEEP
12288:+eJ/sIU9Thtw2th1kfQe4fiGL0c4dwuS3iQRpS2Z5RzG1edBSj81tVimOMt+E:SHwqh1kIev40c43AiQ22zRzG8dA8imX
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.rapidcheckng.com - Port:
587 - Username:
rapidcheck@rapidcheckng.com - Password:
@Rapidcheckng# - Email To:
ebukafale2@gmail.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
TT Copy.exedescription pid process target process PID 1964 set thread context of 1800 1964 TT Copy.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
TT Copy.exepowershell.exepid process 1964 TT Copy.exe 1964 TT Copy.exe 1732 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
TT Copy.exeRegSvcs.exepowershell.exedescription pid process Token: SeDebugPrivilege 1964 TT Copy.exe Token: SeDebugPrivilege 1800 RegSvcs.exe Token: SeDebugPrivilege 1732 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
TT Copy.exedescription pid process target process PID 1964 wrote to memory of 1732 1964 TT Copy.exe powershell.exe PID 1964 wrote to memory of 1732 1964 TT Copy.exe powershell.exe PID 1964 wrote to memory of 1732 1964 TT Copy.exe powershell.exe PID 1964 wrote to memory of 1732 1964 TT Copy.exe powershell.exe PID 1964 wrote to memory of 1752 1964 TT Copy.exe schtasks.exe PID 1964 wrote to memory of 1752 1964 TT Copy.exe schtasks.exe PID 1964 wrote to memory of 1752 1964 TT Copy.exe schtasks.exe PID 1964 wrote to memory of 1752 1964 TT Copy.exe schtasks.exe PID 1964 wrote to memory of 1800 1964 TT Copy.exe RegSvcs.exe PID 1964 wrote to memory of 1800 1964 TT Copy.exe RegSvcs.exe PID 1964 wrote to memory of 1800 1964 TT Copy.exe RegSvcs.exe PID 1964 wrote to memory of 1800 1964 TT Copy.exe RegSvcs.exe PID 1964 wrote to memory of 1800 1964 TT Copy.exe RegSvcs.exe PID 1964 wrote to memory of 1800 1964 TT Copy.exe RegSvcs.exe PID 1964 wrote to memory of 1800 1964 TT Copy.exe RegSvcs.exe PID 1964 wrote to memory of 1800 1964 TT Copy.exe RegSvcs.exe PID 1964 wrote to memory of 1800 1964 TT Copy.exe RegSvcs.exe PID 1964 wrote to memory of 1800 1964 TT Copy.exe RegSvcs.exe PID 1964 wrote to memory of 1800 1964 TT Copy.exe RegSvcs.exe PID 1964 wrote to memory of 1800 1964 TT Copy.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TT Copy.exe"C:\Users\Admin\AppData\Local\Temp\TT Copy.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YmqxAO.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YmqxAO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC4A7.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC4A7.tmpFilesize
1KB
MD596156c94e64cd88a2d043a9093e3aa1c
SHA1e8ed14f4b580a5965400b9669cac825f921d6397
SHA256d9dc3ea9287ea7614bf38e45bb8094b368ccddd1a75f5bc616ee7af95b2433c0
SHA5127fe1a34eed0721a27294b71f5270eb5a3b3e5a5192e45d3b2a3be496b16cb2709f95130cfbcba2964b8ed792187a575ac1be3a2d13e945724be1ee47a02f3b23
-
memory/1732-83-0x00000000026F0000-0x0000000002730000-memory.dmpFilesize
256KB
-
memory/1732-84-0x00000000026F0000-0x0000000002730000-memory.dmpFilesize
256KB
-
memory/1800-75-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1800-73-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1800-82-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1800-80-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1800-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1800-78-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1800-76-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1800-74-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1964-62-0x0000000000450000-0x000000000045C000-memory.dmpFilesize
48KB
-
memory/1964-72-0x0000000000DA0000-0x0000000000DD2000-memory.dmpFilesize
200KB
-
memory/1964-69-0x0000000004B40000-0x0000000004B80000-memory.dmpFilesize
256KB
-
memory/1964-56-0x0000000000420000-0x000000000042A000-memory.dmpFilesize
40KB
-
memory/1964-54-0x0000000000E00000-0x0000000000EAE000-memory.dmpFilesize
696KB
-
memory/1964-63-0x0000000005A60000-0x0000000005AD6000-memory.dmpFilesize
472KB
-
memory/1964-58-0x0000000004B40000-0x0000000004B80000-memory.dmpFilesize
256KB
-
memory/1964-61-0x0000000004B40000-0x0000000004B80000-memory.dmpFilesize
256KB
-
memory/1964-60-0x0000000004B40000-0x0000000004B80000-memory.dmpFilesize
256KB
-
memory/1964-59-0x0000000000440000-0x000000000044E000-memory.dmpFilesize
56KB
-
memory/1964-57-0x0000000000420000-0x000000000042A000-memory.dmpFilesize
40KB
-
memory/1964-55-0x0000000004B40000-0x0000000004B80000-memory.dmpFilesize
256KB