Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
14-10-2021 05:56
General
-
Target
Payment_Swift,png.exe
-
Size
275KB
-
MD5
f589816b35976438b88a621266d7d071
-
SHA1
1a845d22e5378b8771536806bb312f6ded7b1046
-
SHA256
e4c466fd6fb96b2ffc5682a75154df8501c8edb5234b14349ba5c01afc717b12
-
SHA512
c6a92f6520791f55b3603472451d09a7ab659cc93f5d66fabaece8293432889be07830a21da65cf8ee2b72d24890e7f571649e9a6f30ece48e7858549a349d67
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.alishair.rs - Port:
587 - Username:
info@alishair.rs - Password:
qR8JmTXtlKf0
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment_Swift,png.exe"C:\Users\Admin\AppData\Local\Temp\Payment_Swift,png.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment_Swift,png.exe"C:\Users\Admin\AppData\Local\Temp\Payment_Swift,png.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsk9E93.tmp\qxtkzfqfq.dllMD5
0a629d4790598a83061d053f4a3aa8aa
SHA1f1c78ca24c874e7fc6a7028703c17672bc91167b
SHA25607190acb0aed8a2899cd3edd16e08e1029c105c5808f7023f3320d3c6378833c
SHA5129f9af53ef9cfcf9d231a4922516483671043a552c06c9310a36a4bff631f8f8624b1abbcaa8d4083e7b2e1dea4aaac7960e25a90770dedc1c1ab106ce502a9d0
-
memory/2756-116-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2756-117-0x000000000040188B-mapping.dmp
-
memory/2756-118-0x0000000002220000-0x0000000002257000-memory.dmpFilesize
220KB
-
memory/2756-120-0x0000000004840000-0x0000000004841000-memory.dmpFilesize
4KB
-
memory/2756-122-0x00000000022D0000-0x00000000022D1000-memory.dmpFilesize
4KB
-
memory/2756-121-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2756-123-0x00000000022D2000-0x00000000022D3000-memory.dmpFilesize
4KB
-
memory/2756-125-0x0000000004E70000-0x0000000004E71000-memory.dmpFilesize
4KB
-
memory/2756-124-0x00000000022D3000-0x00000000022D4000-memory.dmpFilesize
4KB
-
memory/2756-126-0x00000000022D4000-0x00000000022D5000-memory.dmpFilesize
4KB
-
memory/2756-127-0x00000000057B0000-0x00000000057B1000-memory.dmpFilesize
4KB
-
memory/2756-128-0x00000000057E0000-0x00000000057E1000-memory.dmpFilesize
4KB
-
memory/2756-129-0x0000000005B90000-0x0000000005B91000-memory.dmpFilesize
4KB
-
memory/2756-130-0x0000000005660000-0x0000000005661000-memory.dmpFilesize
4KB