Analysis
- max time kernel
142s - max time network
122s - platform
windows10_x64 - resource
win10v20210408 - submitted
09/09/2021, 08:23
General
- Target SOA_outstanding Details dd 09092021.exe
- Size 754KB
- Sample210909-j96l7sbabn
- SHA256 bcbb8ef49102239e76868d2f4e23ded5e32ecb03fd7590dcd511aff5fd76b529
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.zfftcn.com
-
Port
587
-
Username
-
Password
%^QQLa^sa4
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- Drops file in Drivers directory 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SOA_outstanding Details dd 09092021.exe"C:\Users\Admin\AppData\Local\Temp\SOA_outstanding Details dd 09092021.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SOA_outstanding Details dd 09092021.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SOA_outstanding Details dd 09092021.exe"C:\Users\Admin\AppData\Local\Temp\SOA_outstanding Details dd 09092021.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SOA_outstanding Details dd 09092021.exe"C:\Users\Admin\AppData\Local\Temp\SOA_outstanding Details dd 09092021.exe"2⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/632-146-0x0000000007BA0000-0x0000000007BA1000-memory.dmp
memory/632-162-0x0000000008990000-0x0000000008991000-memory.dmp
memory/632-370-0x0000000008E70000-0x0000000008E71000-memory.dmp
memory/632-362-0x0000000008E80000-0x0000000008E81000-memory.dmp
memory/632-237-0x0000000004143000-0x0000000004144000-memory.dmp
memory/632-168-0x0000000008ED0000-0x0000000008ED1000-memory.dmp
memory/632-167-0x0000000008B60000-0x0000000008B61000-memory.dmp
memory/632-161-0x000000007E490000-0x000000007E491000-memory.dmp
memory/632-136-0x0000000007230000-0x0000000007231000-memory.dmp
memory/632-140-0x0000000004142000-0x0000000004143000-memory.dmp
memory/632-129-0x0000000006C00000-0x0000000006C01000-memory.dmp
memory/632-154-0x00000000089B0000-0x00000000089E3000-memory.dmp
memory/632-145-0x0000000007D70000-0x0000000007D71000-memory.dmp
memory/632-144-0x0000000007900000-0x0000000007901000-memory.dmp
memory/632-133-0x0000000006940000-0x0000000006941000-memory.dmp
memory/632-141-0x00000000074F0000-0x00000000074F1000-memory.dmp
memory/632-139-0x0000000004140000-0x0000000004141000-memory.dmp
memory/632-128-0x0000000004100000-0x0000000004101000-memory.dmp
memory/1652-142-0x00000000054D0000-0x00000000059CE000-memory.dmp
memory/1652-387-0x00000000054D0000-0x00000000059CE000-memory.dmp
memory/1652-368-0x0000000005980000-0x0000000005981000-memory.dmp
memory/1652-130-0x0000000000400000-0x000000000043C000-memory.dmp
memory/4796-122-0x0000000008E30000-0x0000000008E94000-memory.dmp
memory/4796-114-0x0000000000F10000-0x0000000000F11000-memory.dmp
memory/4796-123-0x000000000B7A0000-0x000000000B7D8000-memory.dmp
memory/4796-125-0x000000000E850000-0x000000000E851000-memory.dmp
memory/4796-121-0x0000000005C20000-0x0000000005C36000-memory.dmp
memory/4796-120-0x0000000008ED0000-0x0000000008ED1000-memory.dmp
memory/4796-119-0x0000000005770000-0x0000000005C6E000-memory.dmp
memory/4796-116-0x0000000005C70000-0x0000000005C71000-memory.dmp
memory/4796-118-0x00000000058B0000-0x00000000058B1000-memory.dmp
memory/4796-117-0x0000000005810000-0x0000000005811000-memory.dmp