Analysis

  • max time kernel
    92s
  • max time network
    314s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    21-10-2021 04:08

General

  • Target

    PO15410.EXE

  • Size

    444KB

  • MD5

    9b1519dc04911fd229573b20acad1983

  • SHA1

    05e54448c5a980debe1f3b6478e3ff38b0abdaf9

  • SHA256

    3c6e548734714e341da1909e80c49a7433955d630fc2eb4ddc9c1cd26d366c09

  • SHA512

    0e7d57095af4af2b9ffbe7d94a33c346ea7da04a1df8300da2c9cd7661aeba77d91ba055f068ba75d2169fbf76a7c67cba728d5442aebc053c45bcea39a31a1b

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.tanzanitecoffee.co.tz
  • Port:
    587
  • Username:
    info@tanzanitecoffee.co.tz
  • Password:
    Tanzanitecoffee2018

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO15410.EXE
    "C:\Users\Admin\AppData\Local\Temp\PO15410.EXE"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Users\Admin\AppData\Local\Temp\PO15410.EXE
      "C:\Users\Admin\AppData\Local\Temp\PO15410.EXE"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:3732

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsbE08E.tmp\xtoboozpmf.dll
    MD5

    f23b6a2bf1059f874ac2764883cabdb5

    SHA1

    d36c4b7a5a7daf33d98fdacd24fa4e070b738610

    SHA256

    e25f8dfba5d8f067cac8a03e0fcd19371baa2b0f9d94faca758565b4d9015a89

    SHA512

    f14ffb67fd1bf3705ef0d511f8261e86247322ca06726a60b513ef257e838dad27b29f1758c02a32228f01a6b2eeb7617d70ad1d7472b9c3a260d78c00bf8e55

  • memory/3732-116-0x0000000000400000-0x000000000044C000-memory.dmp
    Filesize

    304KB

  • memory/3732-117-0x000000000040188B-mapping.dmp
  • memory/3732-118-0x00000000009F0000-0x0000000000A27000-memory.dmp
    Filesize

    220KB

  • memory/3732-120-0x0000000004960000-0x0000000004961000-memory.dmp
    Filesize

    4KB

  • memory/3732-121-0x0000000004F20000-0x0000000004F21000-memory.dmp
    Filesize

    4KB

  • memory/3732-123-0x0000000004950000-0x0000000004951000-memory.dmp
    Filesize

    4KB

  • memory/3732-122-0x0000000000400000-0x000000000044C000-memory.dmp
    Filesize

    304KB

  • memory/3732-124-0x0000000004952000-0x0000000004953000-memory.dmp
    Filesize

    4KB

  • memory/3732-125-0x0000000004953000-0x0000000004954000-memory.dmp
    Filesize

    4KB

  • memory/3732-126-0x0000000004954000-0x0000000004955000-memory.dmp
    Filesize

    4KB

  • memory/3732-127-0x00000000057B0000-0x00000000057B1000-memory.dmp
    Filesize

    4KB

  • memory/3732-128-0x00000000057E0000-0x00000000057E1000-memory.dmp
    Filesize

    4KB

  • memory/3732-129-0x0000000000690000-0x0000000000691000-memory.dmp
    Filesize

    4KB

  • memory/3732-130-0x0000000000740000-0x0000000000741000-memory.dmp
    Filesize

    4KB