Analysis
- max time kernel
136s - max time network
121s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
27/12/2021, 12:31
General
- Target SKM908110098 draft documents sailing hyundai colombo,pdf.exe
- Size 1.2MB
- Sample211227-pp2qeabbgp
- SHA256 e9ce1184d7a415e812e294ca6a8757ba5288b6a2fdee887a7e64325c553d909c
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.ozokgroup.com
-
Port
587
-
Username
-
Password
Aozok1960.
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 4 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SKM908110098 draft documents sailing hyundai colombo,pdf.exe"C:\Users\Admin\AppData\Local\Temp\SKM908110098 draft documents sailing hyundai colombo,pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jFmUFWQqlRByQ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFmUFWQqlRByQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB031.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\SKM908110098 draft documents sailing hyundai colombo,pdf.exe"C:\Users\Admin\AppData\Local\Temp\SKM908110098 draft documents sailing hyundai colombo,pdf.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/864-141-0x00000000077C0000-0x0000000007826000-memory.dmp
memory/864-163-0x0000000009860000-0x000000000987E000-memory.dmp
memory/864-377-0x0000000009B30000-0x0000000009B38000-memory.dmp
memory/864-372-0x0000000009B30000-0x0000000009B38000-memory.dmp
memory/864-371-0x0000000009B50000-0x0000000009B6A000-memory.dmp
memory/864-143-0x0000000008040000-0x0000000008390000-memory.dmp
memory/864-207-0x0000000004EF3000-0x0000000004EF4000-memory.dmp
memory/864-170-0x0000000009BF0000-0x0000000009C84000-memory.dmp
memory/864-169-0x00000000099C0000-0x0000000009A65000-memory.dmp
memory/864-126-0x0000000003260000-0x0000000003261000-memory.dmp
memory/864-127-0x0000000003260000-0x0000000003261000-memory.dmp
memory/864-164-0x000000007FC90000-0x000000007FC91000-memory.dmp
memory/864-129-0x0000000004CC0000-0x0000000004CF6000-memory.dmp
memory/864-142-0x00000000078A0000-0x0000000007906000-memory.dmp
memory/864-162-0x0000000008750000-0x00000000087C6000-memory.dmp
memory/864-161-0x0000000008A10000-0x0000000008A5B000-memory.dmp
memory/864-160-0x00000000078A0000-0x0000000007906000-memory.dmp
memory/864-135-0x0000000007910000-0x0000000007F38000-memory.dmp
memory/864-159-0x00000000077C0000-0x0000000007826000-memory.dmp
memory/864-158-0x0000000007720000-0x0000000007742000-memory.dmp
memory/864-144-0x00000000083B0000-0x00000000083CC000-memory.dmp
memory/864-138-0x0000000004EF2000-0x0000000004EF3000-memory.dmp
memory/864-156-0x0000000009880000-0x00000000098B3000-memory.dmp
memory/864-140-0x0000000007720000-0x0000000007742000-memory.dmp
memory/864-157-0x0000000009880000-0x00000000098B3000-memory.dmp
memory/864-155-0x0000000007910000-0x0000000007F38000-memory.dmp
memory/864-366-0x0000000009B50000-0x0000000009B6A000-memory.dmp
memory/864-137-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/864-145-0x0000000008A10000-0x0000000008A5B000-memory.dmp
memory/864-146-0x0000000008750000-0x00000000087C6000-memory.dmp
memory/864-147-0x0000000003260000-0x0000000003261000-memory.dmp
memory/2564-130-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2564-388-0x0000000006480000-0x000000000648A000-memory.dmp
memory/2564-139-0x0000000005350000-0x000000000584E000-memory.dmp
memory/2564-136-0x0000000005590000-0x000000000562C000-memory.dmp
memory/2564-134-0x0000000005850000-0x0000000005D4E000-memory.dmp
memory/2564-133-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2564-132-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2564-387-0x00000000067B0000-0x0000000006842000-memory.dmp
memory/2564-243-0x00000000060B0000-0x0000000006116000-memory.dmp
memory/2564-242-0x0000000005820000-0x0000000005838000-memory.dmp
memory/3532-121-0x0000000005040000-0x0000000005050000-memory.dmp
memory/3532-122-0x00000000071D0000-0x000000000726C000-memory.dmp
memory/3532-117-0x0000000005430000-0x000000000592E000-memory.dmp
memory/3532-116-0x0000000000490000-0x00000000005C6000-memory.dmp
memory/3532-120-0x0000000004DF0000-0x0000000004DFA000-memory.dmp
memory/3532-119-0x0000000004F30000-0x000000000542E000-memory.dmp
memory/3532-118-0x0000000004E30000-0x0000000004EC2000-memory.dmp
memory/3532-123-0x0000000007370000-0x00000000073E2000-memory.dmp
memory/3532-115-0x0000000000490000-0x00000000005C6000-memory.dmp