Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-10-2021 08:16
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
1.exe
-
Size
475KB
-
MD5
63272d6116e99e0ba7f0576eae74b73f
-
SHA1
d67eb4467ba29fda766d06f72e525e0f492744d6
-
SHA256
18835a65226f3e12ce4712f8c60afb32d1b87cc4938562e96ebdd87e9505807d
-
SHA512
3518a6f0dccd9e96008c70eda479fdb4da14784f090ab600fdb6a725648afbb972e7c69ab16c578dd5a2855c6217b7161f157de7048b3ff4f4eba434f1faa221
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
smtp.gailanz.com - Port:
587 - Username:
champ.zhu@gailanz.com - Password:
l0j@cL$9t}Zw
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/720-61-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/720-62-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/720-64-0x0000000000436C4E-mapping.dmp family_agenttesla behavioral1/memory/720-63-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/720-65-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1.exedescription pid process target process PID 1768 set thread context of 720 1768 1.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
MSBuild.exepid process 720 MSBuild.exe 720 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 720 MSBuild.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
1.exedescription pid process target process PID 1768 wrote to memory of 720 1768 1.exe MSBuild.exe PID 1768 wrote to memory of 720 1768 1.exe MSBuild.exe PID 1768 wrote to memory of 720 1768 1.exe MSBuild.exe PID 1768 wrote to memory of 720 1768 1.exe MSBuild.exe PID 1768 wrote to memory of 720 1768 1.exe MSBuild.exe PID 1768 wrote to memory of 720 1768 1.exe MSBuild.exe PID 1768 wrote to memory of 720 1768 1.exe MSBuild.exe PID 1768 wrote to memory of 720 1768 1.exe MSBuild.exe PID 1768 wrote to memory of 720 1768 1.exe MSBuild.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/720-64-0x0000000000436C4E-mapping.dmp
-
memory/720-59-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/720-60-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/720-61-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/720-62-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/720-63-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/720-65-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/720-67-0x0000000004480000-0x0000000004481000-memory.dmpFilesize
4KB
-
memory/1768-55-0x0000000075821000-0x0000000075823000-memory.dmpFilesize
8KB
-
memory/1768-56-0x0000000000800000-0x0000000000807000-memory.dmpFilesize
28KB
-
memory/1768-57-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/1768-58-0x0000000004FD0000-0x0000000005027000-memory.dmpFilesize
348KB
-
memory/1768-53-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB