Analysis
-
max time kernel
151s -
max time network
137s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
19-10-2021 14:59
General
-
Target
c1b4b9ffcd81e9a4516400f9fc38a4d3.exe
-
Size
1.1MB
-
MD5
c1b4b9ffcd81e9a4516400f9fc38a4d3
-
SHA1
3605dec02e7f6480262eb5cae77ada772324bb2b
-
SHA256
4ed0b0474741e959230eb8a17efbc5e0db94fba7f46499596dd6359b4cf16637
-
SHA512
f7ff356b06b1eb2f9babc850727907748c50b5868a241a6b4746e92104d806c67b3034a73559a2ca0819c6e4b66e17e1bbcd856ba7ca4d16d3f283e827dd0c5e
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.lko-import.de - Port:
587 - Username:
[email protected] - Password:
TVMHSiW5
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
AgentTesla Payload 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1b4b9ffcd81e9a4516400f9fc38a4d3.exe"C:\Users\Admin\AppData\Local\Temp\c1b4b9ffcd81e9a4516400f9fc38a4d3.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\75093774\edootqca.pif"C:\75093774\edootqca.pif" ttbfbsnkx.mna2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\75093774\run.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\75093774\edootqca.pif"C:\75093774\edootqca.pif" ttbfbsnkx.mna4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
1d7071dd5cda216508b235c0e2318b05
SHA10b972fbc1ea8a47204b2a187e608744a4e947bc2
SHA256788edeacd860a1a3bb22b839c1ecf408227e1e14bbe0b1baf55824075161f996
SHA51265965d2de629024773dddf5f8f37d40a15afc51cbaec48c8cda3b0763e9391e065c5ee6ab81b7f4e53ab1f531ef53bb9dccd9ddd4a1c9423922eebf37e544118
-
MD5
1d7071dd5cda216508b235c0e2318b05
SHA10b972fbc1ea8a47204b2a187e608744a4e947bc2
SHA256788edeacd860a1a3bb22b839c1ecf408227e1e14bbe0b1baf55824075161f996
SHA51265965d2de629024773dddf5f8f37d40a15afc51cbaec48c8cda3b0763e9391e065c5ee6ab81b7f4e53ab1f531ef53bb9dccd9ddd4a1c9423922eebf37e544118
-
MD5
1d7071dd5cda216508b235c0e2318b05
SHA10b972fbc1ea8a47204b2a187e608744a4e947bc2
SHA256788edeacd860a1a3bb22b839c1ecf408227e1e14bbe0b1baf55824075161f996
SHA51265965d2de629024773dddf5f8f37d40a15afc51cbaec48c8cda3b0763e9391e065c5ee6ab81b7f4e53ab1f531ef53bb9dccd9ddd4a1c9423922eebf37e544118
-
MD5
38939658603af998024840687166081f
SHA1bfdb8628c8a6c5e595a2c847bbeb756940a1e2a3
SHA2562094a89efd01e941414d28ac31122aea61b0a96979b943e1ea346a9f095afd14
SHA5128d00dfe951ab06f967d687788b0baed64cb6525f576025b8940234e6a6b5ae845171588d314a65bbebf9291c634092d457fafb44d6cce77e7b3149376226ce9e
-
MD5
d81275240c2366091efdb312489a650d
SHA1e7ce977c11a260c384ad434dad9737a3e94605fe
SHA256978a647a98ed15a53d655f0abf34549db7ab647a8fd87117e9c6af1a31f5daf9
SHA512b7ac2f55c34b2098c3968647fb806289fdff9b2de6bd7ae28523112a087627106613551b7ec19f7675fbe850580c28a0f57099c90a0f7e6dfec3cbd5edc5642a
-
MD5
1e9004bd0403298a96483c61e1e85995
SHA1bf9a6d9c00c43ea7b5054c04d0526c695a721e7d
SHA256a938ab1fd8cbf75992f1165d689911fffe0223479f6f2f6db8f34bb1bd83ebdd
SHA512c42f9a5c5c4af57b5d37b17ee87539a83926d0357b0079a42042f55a6a3eb5e34ac604dd3b766e951134eeb6e8fcec6094ed7d0ac82ab30338965523a2cda76d
-
MD5
e86bc8d921ac0b38387c090d249ca353
SHA19bf5800dbb9502c1e81e39a663de50f76b45da3a
SHA2567c5658d6106669337a112f20a48a5441deb54d5483a1624cd9c23b061c4a32b2
SHA51291a714c3911607a54e14fa2a009fc0324db4705bd6f07e7ba02ffaad8eae3b38b579a89aaa9f74c0e7211f1fc2addf5fc1042c7ff9adc58c5506f209bb97cf97
-
Filesize
4.9MB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.0MB
-
-
-