Analysis
-
max time kernel
134s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
20-10-2021 14:05
Static task
static1
Behavioral task
behavioral1
Sample
g9XCQOMvwhPEV6L.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
g9XCQOMvwhPEV6L.exe
Resource
win10-en-20210920
General
-
Target
g9XCQOMvwhPEV6L.exe
-
Size
436KB
-
MD5
272949acab6b71a4819f040bc4f0c5c4
-
SHA1
ba714a50c8b67e5b951ab74ef5c201884ef223f0
-
SHA256
2d7c5f6f54961f7bad156c7fd858c1718218fccc731ccd45f75f7180d03d921c
-
SHA512
aca3035eb6a102beeb9497783a0828f4acfc1defefafc702b0b50bb2a7f74f89066b7f6847f4a0df8e41a24715e52955327ded4fd97d82aa45e0b2d581768cb5
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.goldentravel.ec - Port:
587 - Username:
[email protected] - Password:
chinadusco@5555343
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3520-124-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/3520-125-0x000000000043772E-mapping.dmp family_agenttesla behavioral2/memory/3520-131-0x00000000054E0000-0x00000000059DE000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
g9XCQOMvwhPEV6L.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts g9XCQOMvwhPEV6L.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
g9XCQOMvwhPEV6L.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 g9XCQOMvwhPEV6L.exe Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 g9XCQOMvwhPEV6L.exe Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 g9XCQOMvwhPEV6L.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
g9XCQOMvwhPEV6L.exedescription pid process target process PID 2416 set thread context of 3520 2416 g9XCQOMvwhPEV6L.exe g9XCQOMvwhPEV6L.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
g9XCQOMvwhPEV6L.exepid process 3520 g9XCQOMvwhPEV6L.exe 3520 g9XCQOMvwhPEV6L.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
g9XCQOMvwhPEV6L.exedescription pid process Token: SeDebugPrivilege 3520 g9XCQOMvwhPEV6L.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
g9XCQOMvwhPEV6L.exedescription pid process target process PID 2416 wrote to memory of 3520 2416 g9XCQOMvwhPEV6L.exe g9XCQOMvwhPEV6L.exe PID 2416 wrote to memory of 3520 2416 g9XCQOMvwhPEV6L.exe g9XCQOMvwhPEV6L.exe PID 2416 wrote to memory of 3520 2416 g9XCQOMvwhPEV6L.exe g9XCQOMvwhPEV6L.exe PID 2416 wrote to memory of 3520 2416 g9XCQOMvwhPEV6L.exe g9XCQOMvwhPEV6L.exe PID 2416 wrote to memory of 3520 2416 g9XCQOMvwhPEV6L.exe g9XCQOMvwhPEV6L.exe PID 2416 wrote to memory of 3520 2416 g9XCQOMvwhPEV6L.exe g9XCQOMvwhPEV6L.exe PID 2416 wrote to memory of 3520 2416 g9XCQOMvwhPEV6L.exe g9XCQOMvwhPEV6L.exe PID 2416 wrote to memory of 3520 2416 g9XCQOMvwhPEV6L.exe g9XCQOMvwhPEV6L.exe -
outlook_office_path 1 IoCs
Processes:
g9XCQOMvwhPEV6L.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 g9XCQOMvwhPEV6L.exe -
outlook_win_path 1 IoCs
Processes:
g9XCQOMvwhPEV6L.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 g9XCQOMvwhPEV6L.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\g9XCQOMvwhPEV6L.exe"C:\Users\Admin\AppData\Local\Temp\g9XCQOMvwhPEV6L.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\g9XCQOMvwhPEV6L.exe"C:\Users\Admin\AppData\Local\Temp\g9XCQOMvwhPEV6L.exe"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3520
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\g9XCQOMvwhPEV6L.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
memory/2416-122-0x0000000008350000-0x0000000008351000-memory.dmpFilesize
4KB
-
memory/2416-118-0x0000000004D10000-0x0000000004D11000-memory.dmpFilesize
4KB
-
memory/2416-119-0x0000000004C50000-0x0000000004C51000-memory.dmpFilesize
4KB
-
memory/2416-120-0x0000000004D10000-0x000000000520E000-memory.dmpFilesize
5.0MB
-
memory/2416-121-0x0000000004F30000-0x0000000004F37000-memory.dmpFilesize
28KB
-
memory/2416-115-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/2416-123-0x00000000084F0000-0x0000000008548000-memory.dmpFilesize
352KB
-
memory/2416-117-0x0000000005210000-0x0000000005211000-memory.dmpFilesize
4KB
-
memory/3520-124-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3520-125-0x000000000043772E-mapping.dmp
-
memory/3520-131-0x00000000054E0000-0x00000000059DE000-memory.dmpFilesize
5.0MB
-
memory/3520-132-0x0000000005990000-0x0000000005991000-memory.dmpFilesize
4KB
-
memory/3520-133-0x0000000006140000-0x0000000006141000-memory.dmpFilesize
4KB