Analysis
-
max time kernel
112s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
13/04/2023, 12:02
Static task
static1
Behavioral task
behavioral1
Sample
z0Transferslip.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
z0Transferslip.exe
Resource
win10v2004-20230220-en
General
-
Target
z0Transferslip.exe
-
Size
692KB
-
MD5
523420934008337bc65cd0ee6a40adbf
-
SHA1
6e21b99481d21aab127e702a7b6a4582255ed18e
-
SHA256
8bdb93748c95f7288c8e062db2c2ebff27e89c6e0f031f1c527016d5140f37b2
-
SHA512
098fdae6e0265663ff49b30f3685a509bd997207bb818f6d4f837b4ec7a6e02c65d7286500e8ecdde9bf0fa167e4b3be6ff1173bdc479c49fff1af6cc2f19264
-
SSDEEP
12288:ntwI0pW48+hNknKT7GJejOtysczjLdhys//HzrgML3OEfKvajdC8Qi5fliadEIP1:9617GJrYvXLdhys3TrgMrOEff5C8Qi5L
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6192832133:AAF7C5Hu2cAny_oozlOAGw_7DWfvYVumEbE/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation z0Transferslip.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yGbzOMp = "C:\\Users\\Admin\\AppData\\Roaming\\yGbzOMp\\yGbzOMp.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1200 set thread context of 2772 1200 z0Transferslip.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3544 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1200 z0Transferslip.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1200 z0Transferslip.exe Token: SeDebugPrivilege 2772 RegSvcs.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1200 wrote to memory of 3544 1200 z0Transferslip.exe 91 PID 1200 wrote to memory of 3544 1200 z0Transferslip.exe 91 PID 1200 wrote to memory of 3544 1200 z0Transferslip.exe 91 PID 1200 wrote to memory of 2772 1200 z0Transferslip.exe 93 PID 1200 wrote to memory of 2772 1200 z0Transferslip.exe 93 PID 1200 wrote to memory of 2772 1200 z0Transferslip.exe 93 PID 1200 wrote to memory of 2772 1200 z0Transferslip.exe 93 PID 1200 wrote to memory of 2772 1200 z0Transferslip.exe 93 PID 1200 wrote to memory of 2772 1200 z0Transferslip.exe 93 PID 1200 wrote to memory of 2772 1200 z0Transferslip.exe 93 PID 1200 wrote to memory of 2772 1200 z0Transferslip.exe 93 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\z0Transferslip.exe"C:\Users\Admin\AppData\Local\Temp\z0Transferslip.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XizZqQpvSyj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp"2⤵
- Creates scheduled task(s)
PID:3544
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2772
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ef354e22f0d4717337892706f21c82b0
SHA1d64adb21d2999ce0400e5192ba3f9713c92aaf9b
SHA2564b79c734ba3de5274a7b18a194d8cd6e5e38b89b6295cc7199cd57ca441436bd
SHA512fe37a0fca5f3541d5c885fcf6410d4ca8caf6ea8533a0c28ac5a2c715a44adcadade88165805c5b515142d36cb0ffd9c7d65e91b7faa798de0679a305906efa1