Analysis
-
max time kernel
92s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
22-10-2021 06:34
Static task
static1
Behavioral task
behavioral1
Sample
POIM101385.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
POIM101385.exe
Resource
win10-en-20210920
General
-
Target
POIM101385.exe
-
Size
453KB
-
MD5
f1e3f54edbeffd5786fb49487872f2e3
-
SHA1
22418d61c9a779f6a1e651928ba86b36755abd78
-
SHA256
e66ed8d87430588f029d4ed6787d54de508b271fca3d2266023ae1f0c69d75e2
-
SHA512
c8a029af97c5ded5cb3aaccba31b6f0753d6a92c49c93f22e1cc20061ec2a29fd2d033b643e1fa4ea1f39f3cb1a9fa4980aae078c9a510e717ec294a260316a1
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3852-116-0x0000000000400000-0x000000000044B000-memory.dmp family_agenttesla behavioral2/memory/3852-117-0x000000000040188B-mapping.dmp family_agenttesla behavioral2/memory/3852-118-0x0000000000400000-0x000000000044B000-memory.dmp family_agenttesla -
Loads dropped DLL 1 IoCs
Processes:
POIM101385.exepid process 2780 POIM101385.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
POIM101385.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 POIM101385.exe Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 POIM101385.exe Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 POIM101385.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
POIM101385.exedescription pid process target process PID 2780 set thread context of 3852 2780 POIM101385.exe POIM101385.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
POIM101385.exepid process 3852 POIM101385.exe 3852 POIM101385.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
POIM101385.exedescription pid process Token: SeDebugPrivilege 3852 POIM101385.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
POIM101385.exedescription pid process target process PID 2780 wrote to memory of 3852 2780 POIM101385.exe POIM101385.exe PID 2780 wrote to memory of 3852 2780 POIM101385.exe POIM101385.exe PID 2780 wrote to memory of 3852 2780 POIM101385.exe POIM101385.exe PID 2780 wrote to memory of 3852 2780 POIM101385.exe POIM101385.exe PID 2780 wrote to memory of 3852 2780 POIM101385.exe POIM101385.exe PID 2780 wrote to memory of 3852 2780 POIM101385.exe POIM101385.exe PID 2780 wrote to memory of 3852 2780 POIM101385.exe POIM101385.exe PID 2780 wrote to memory of 3852 2780 POIM101385.exe POIM101385.exe PID 2780 wrote to memory of 3852 2780 POIM101385.exe POIM101385.exe PID 2780 wrote to memory of 3852 2780 POIM101385.exe POIM101385.exe -
outlook_office_path 1 IoCs
Processes:
POIM101385.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 POIM101385.exe -
outlook_win_path 1 IoCs
Processes:
POIM101385.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 POIM101385.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\POIM101385.exe"C:\Users\Admin\AppData\Local\Temp\POIM101385.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\POIM101385.exe"C:\Users\Admin\AppData\Local\Temp\POIM101385.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsxA2CA.tmp\cxapxirycmq.dllMD5
f9c99f7e3b80bd0757ccad6a4ee2c795
SHA1e487ee3c5fc3d1e0817a8c5646ed042312a8ad83
SHA256963d2beb680b2f7b490063c3f248ae28fdadec39b0b9542c4b79a48f07bbd907
SHA512c4ed2f2dc2b6d79f3f37433023428bfe7607360e257864e29fab249619e666df5b00542640d89f29ae510f83e514b41eba14fcc3232e9416a0b8e248eb59b01c
-
memory/3852-116-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/3852-117-0x000000000040188B-mapping.dmp
-
memory/3852-119-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/3852-118-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/3852-121-0x00000000021E2000-0x00000000021E4000-memory.dmpFilesize
8KB
-
memory/3852-120-0x00000000021E1000-0x00000000021E2000-memory.dmpFilesize
4KB
-
memory/3852-122-0x00000000021E7000-0x00000000021E8000-memory.dmpFilesize
4KB
-
memory/3852-123-0x00000000021E8000-0x00000000021E9000-memory.dmpFilesize
4KB
-
memory/3852-124-0x00000000021ED000-0x00000000021EF000-memory.dmpFilesize
8KB