Analysis
- max time kernel
135s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
17/11/2021, 07:42
General
- Target BOQ 11745692.exe
- Size 858KB
- Sample211117-jjpk1aefcm
- SHA256 5abf356c34fac462b7977aa7ee02ea4e072764d6acb7803fd9591af68e6a2429
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.logos-cy.com
-
Port
587
-
Username
-
Password
(l#YT%^6
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 1 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BOQ 11745692.exe"C:\Users\Admin\AppData\Local\Temp\BOQ 11745692.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\BOQ 11745692.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2132-126-0x00000000088E0000-0x0000000008916000-memory.dmp
memory/2132-117-0x0000000005BC0000-0x0000000005BC1000-memory.dmp
memory/2132-118-0x00000000056C0000-0x00000000056C1000-memory.dmp
memory/2132-119-0x00000000056C0000-0x0000000005BBE000-memory.dmp
memory/2132-120-0x00000000057B0000-0x00000000057B1000-memory.dmp
memory/2132-121-0x0000000005900000-0x0000000005907000-memory.dmp
memory/2132-122-0x0000000007DF0000-0x0000000007DF1000-memory.dmp
memory/2132-123-0x0000000007F90000-0x0000000007FE8000-memory.dmp
memory/2132-124-0x0000000007FF0000-0x0000000008029000-memory.dmp
memory/2132-115-0x0000000000C00000-0x0000000000C01000-memory.dmp
memory/2192-130-0x0000000004600000-0x0000000004601000-memory.dmp
memory/2192-137-0x0000000007E60000-0x0000000007E61000-memory.dmp
memory/2192-128-0x0000000002D00000-0x0000000002D01000-memory.dmp
memory/2192-129-0x0000000004690000-0x0000000004691000-memory.dmp
memory/2192-131-0x0000000007060000-0x0000000007061000-memory.dmp
memory/2192-132-0x0000000006FB0000-0x0000000006FB1000-memory.dmp
memory/2192-133-0x0000000007790000-0x0000000007791000-memory.dmp
memory/2192-134-0x0000000007800000-0x0000000007801000-memory.dmp
memory/2192-135-0x0000000007A50000-0x0000000007A51000-memory.dmp
memory/2192-136-0x0000000004602000-0x0000000004603000-memory.dmp
memory/2192-127-0x0000000002D00000-0x0000000002D01000-memory.dmp
memory/2192-138-0x0000000008330000-0x0000000008331000-memory.dmp
memory/2192-139-0x0000000008170000-0x0000000008171000-memory.dmp
memory/2192-140-0x0000000002D00000-0x0000000002D01000-memory.dmp
memory/2192-147-0x0000000009140000-0x0000000009173000-memory.dmp
memory/2192-154-0x0000000009120000-0x0000000009121000-memory.dmp
memory/2192-159-0x0000000009270000-0x0000000009271000-memory.dmp
memory/2192-160-0x0000000009450000-0x0000000009451000-memory.dmp
memory/2192-161-0x000000007F380000-0x000000007F381000-memory.dmp
memory/2192-162-0x0000000004603000-0x0000000004604000-memory.dmp