Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 02:36
Static task
static1
Behavioral task
behavioral1
Sample
new order.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
new order.exe
Resource
win10v2004-20240226-en
General
-
Target
new order.exe
-
Size
668KB
-
MD5
cf021b7974c2665564085795f85a0ede
-
SHA1
d2084747f540500ab61974ac288ab05f9d91334a
-
SHA256
044ce9e194f5194b8d0e12e8e05fc3a3ff3782e60d5b3838351e80ac43663e4d
-
SHA512
cf5d6acecf132c3a01ec82b3f4e8e2c66c854611b6d71b53d2b148fa492c47f800eb443a9e46828fb3cc3b408da571ee86ecc31facb67f8d7bfbd9560b7780aa
-
SSDEEP
12288:iGCCi8LkpEatgdWrtzQswH4X1nqcSg+jEKAEGaCtXm3dCcQBoTY2ZkR:i9ZjE0GqNA4X1ijEKAER023d2BWE
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.springandsummer.lk - Port:
587 - Username:
[email protected] - Password:
anu##323 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 400 powershell.exe 2444 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
new order.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation new order.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
new order.exedescription pid process target process PID 1900 set thread context of 940 1900 new order.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
new order.exepowershell.exepowershell.exeRegSvcs.exepid process 1900 new order.exe 1900 new order.exe 1900 new order.exe 1900 new order.exe 1900 new order.exe 1900 new order.exe 1900 new order.exe 1900 new order.exe 400 powershell.exe 400 powershell.exe 1900 new order.exe 1900 new order.exe 2444 powershell.exe 2444 powershell.exe 940 RegSvcs.exe 940 RegSvcs.exe 940 RegSvcs.exe 400 powershell.exe 2444 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
new order.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1900 new order.exe Token: SeDebugPrivilege 400 powershell.exe Token: SeDebugPrivilege 2444 powershell.exe Token: SeDebugPrivilege 940 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
new order.exedescription pid process target process PID 1900 wrote to memory of 400 1900 new order.exe powershell.exe PID 1900 wrote to memory of 400 1900 new order.exe powershell.exe PID 1900 wrote to memory of 400 1900 new order.exe powershell.exe PID 1900 wrote to memory of 2444 1900 new order.exe powershell.exe PID 1900 wrote to memory of 2444 1900 new order.exe powershell.exe PID 1900 wrote to memory of 2444 1900 new order.exe powershell.exe PID 1900 wrote to memory of 860 1900 new order.exe schtasks.exe PID 1900 wrote to memory of 860 1900 new order.exe schtasks.exe PID 1900 wrote to memory of 860 1900 new order.exe schtasks.exe PID 1900 wrote to memory of 940 1900 new order.exe RegSvcs.exe PID 1900 wrote to memory of 940 1900 new order.exe RegSvcs.exe PID 1900 wrote to memory of 940 1900 new order.exe RegSvcs.exe PID 1900 wrote to memory of 940 1900 new order.exe RegSvcs.exe PID 1900 wrote to memory of 940 1900 new order.exe RegSvcs.exe PID 1900 wrote to memory of 940 1900 new order.exe RegSvcs.exe PID 1900 wrote to memory of 940 1900 new order.exe RegSvcs.exe PID 1900 wrote to memory of 940 1900 new order.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\new order.exe"C:\Users\Admin\AppData\Local\Temp\new order.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\new order.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HKBGOfx.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HKBGOfx" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE0F5.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3852 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5f5ihbbz.lty.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpE0F5.tmpFilesize
1KB
MD5f9814337b074339468fad2e093c847d8
SHA1ba69a27e3fb838e002575e61842afcc0ef8f6b7e
SHA2566e34d52e56770b8e06694853d646f0abf6c25c73151c3d1f198843bde354f77e
SHA512f0786f251849bf3c32e089c2558101c3ddd27a2942bb601ddbb76aa51bf5c3da35ddc1e3d00aff41b6a836830296fbba3d645d927adf2a9299fe857392c7962a
-
memory/400-49-0x00000000064A0000-0x00000000064BE000-memory.dmpFilesize
120KB
-
memory/400-25-0x0000000005DE0000-0x0000000005E46000-memory.dmpFilesize
408KB
-
memory/400-77-0x0000000007830000-0x000000000783A000-memory.dmpFilesize
40KB
-
memory/400-74-0x00000000074C0000-0x0000000007563000-memory.dmpFilesize
652KB
-
memory/400-64-0x0000000006A70000-0x0000000006A8E000-memory.dmpFilesize
120KB
-
memory/400-53-0x0000000070BC0000-0x0000000070C0C000-memory.dmpFilesize
304KB
-
memory/400-52-0x0000000007480000-0x00000000074B2000-memory.dmpFilesize
200KB
-
memory/400-50-0x0000000006820000-0x000000000686C000-memory.dmpFilesize
304KB
-
memory/400-30-0x0000000005E50000-0x0000000005EB6000-memory.dmpFilesize
408KB
-
memory/400-80-0x00000000079C0000-0x00000000079D1000-memory.dmpFilesize
68KB
-
memory/400-16-0x0000000002B50000-0x0000000002B86000-memory.dmpFilesize
216KB
-
memory/400-18-0x0000000005740000-0x0000000005D68000-memory.dmpFilesize
6.2MB
-
memory/400-17-0x0000000074520000-0x0000000074CD0000-memory.dmpFilesize
7.7MB
-
memory/400-19-0x0000000074520000-0x0000000074CD0000-memory.dmpFilesize
7.7MB
-
memory/400-20-0x0000000074520000-0x0000000074CD0000-memory.dmpFilesize
7.7MB
-
memory/400-37-0x0000000005EC0000-0x0000000006214000-memory.dmpFilesize
3.3MB
-
memory/400-22-0x00000000055D0000-0x00000000055F2000-memory.dmpFilesize
136KB
-
memory/400-82-0x0000000007A00000-0x0000000007A14000-memory.dmpFilesize
80KB
-
memory/400-88-0x0000000074520000-0x0000000074CD0000-memory.dmpFilesize
7.7MB
-
memory/940-36-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/940-79-0x00000000066C0000-0x0000000006710000-memory.dmpFilesize
320KB
-
memory/1900-9-0x0000000006BF0000-0x0000000006C74000-memory.dmpFilesize
528KB
-
memory/1900-2-0x0000000005600000-0x0000000005BA4000-memory.dmpFilesize
5.6MB
-
memory/1900-11-0x0000000074520000-0x0000000074CD0000-memory.dmpFilesize
7.7MB
-
memory/1900-39-0x0000000074520000-0x0000000074CD0000-memory.dmpFilesize
7.7MB
-
memory/1900-10-0x0000000009280000-0x000000000931C000-memory.dmpFilesize
624KB
-
memory/1900-4-0x0000000074520000-0x0000000074CD0000-memory.dmpFilesize
7.7MB
-
memory/1900-8-0x00000000055E0000-0x00000000055F0000-memory.dmpFilesize
64KB
-
memory/1900-7-0x000000007452E000-0x000000007452F000-memory.dmpFilesize
4KB
-
memory/1900-6-0x00000000052A0000-0x00000000052BA000-memory.dmpFilesize
104KB
-
memory/1900-3-0x0000000005050000-0x00000000050E2000-memory.dmpFilesize
584KB
-
memory/1900-5-0x0000000005010000-0x000000000501A000-memory.dmpFilesize
40KB
-
memory/1900-0-0x000000007452E000-0x000000007452F000-memory.dmpFilesize
4KB
-
memory/1900-1-0x0000000000570000-0x000000000061A000-memory.dmpFilesize
680KB
-
memory/2444-76-0x00000000075C0000-0x00000000075DA000-memory.dmpFilesize
104KB
-
memory/2444-78-0x0000000007840000-0x00000000078D6000-memory.dmpFilesize
600KB
-
memory/2444-75-0x0000000007C10000-0x000000000828A000-memory.dmpFilesize
6.5MB
-
memory/2444-59-0x0000000070BC0000-0x0000000070C0C000-memory.dmpFilesize
304KB
-
memory/2444-81-0x00000000077F0000-0x00000000077FE000-memory.dmpFilesize
56KB
-
memory/2444-26-0x0000000074520000-0x0000000074CD0000-memory.dmpFilesize
7.7MB
-
memory/2444-83-0x0000000007900000-0x000000000791A000-memory.dmpFilesize
104KB
-
memory/2444-84-0x00000000078E0000-0x00000000078E8000-memory.dmpFilesize
32KB
-
memory/2444-21-0x0000000074520000-0x0000000074CD0000-memory.dmpFilesize
7.7MB
-
memory/2444-87-0x0000000074520000-0x0000000074CD0000-memory.dmpFilesize
7.7MB