6647473163108352.zip
General
Target
Filesize
Completed
3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe
300MB
31-12-2021 10:29
Score
10/10
MD5
SHA1
SHA256
02991d493aedc4e3b544cf5b9ee57499
1de6c330b46ac1de2ec149cdc5c3c4f3da979863
3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a
Malware Config
Extracted
| Family | agenttesla |
| C2 |
https://api.telegram.org/bot2049439171:AAHTF-OzMCy9i3S0b0hmaVc_mUsY0h6Ue_w/sendDocument |
Signatures 12
Filter: none
Collection
Credential Access
-
AgentTesla
Description
Agent Tesla is a remote access tool (RAT) written in visual basic.
Tags
-
AgentTesla Payload
Reported IOCs
resource yara_rule behavioral1/memory/1656-59-0x0000000000070000-0x00000000000AC000-memory.dmp family_agenttesla behavioral1/memory/1656-60-0x0000000000070000-0x00000000000AC000-memory.dmp family_agenttesla behavioral1/memory/1656-62-0x000000000043772E-mapping.dmp family_agenttesla behavioral1/memory/1656-63-0x0000000000070000-0x00000000000AC000-memory.dmp family_agenttesla behavioral1/memory/1656-66-0x0000000000070000-0x00000000000AC000-memory.dmp family_agenttesla behavioral1/memory/1656-69-0x0000000000070000-0x00000000000AC000-memory.dmp family_agenttesla behavioral1/memory/1656-70-0x0000000000070000-0x00000000000AC000-memory.dmp family_agenttesla behavioral1/memory/1656-71-0x0000000000070000-0x00000000000AC000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients
Description
Tries to access configuration files associated with programs like FileZilla.
Tags
TTPs
-
Reads user/profile data of local email clients
Description
Email clients store some user data on disk where infostealers will often target it.
Tags
TTPs
-
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Accesses Microsoft Outlook profiles3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe
Tags
TTPs
Reported IOCs
description ioc process Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe -
Suspicious use of SetThreadContext3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe
Reported IOCs
description pid process target process PID 1084 set thread context of 1656 1084 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe -
Suspicious behavior: EnumeratesProcesses3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe
Reported IOCs
pid process 1656 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe 1656 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe -
Suspicious use of AdjustPrivilegeToken3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 1084 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe Token: SeDebugPrivilege 1656 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe -
Suspicious use of WriteProcessMemory3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe
Reported IOCs
description pid process target process PID 1084 wrote to memory of 1656 1084 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe PID 1084 wrote to memory of 1656 1084 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe PID 1084 wrote to memory of 1656 1084 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe PID 1084 wrote to memory of 1656 1084 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe PID 1084 wrote to memory of 1656 1084 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe PID 1084 wrote to memory of 1656 1084 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe PID 1084 wrote to memory of 1656 1084 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe PID 1084 wrote to memory of 1656 1084 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe PID 1084 wrote to memory of 1656 1084 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe -
outlook_office_path3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe
Reported IOCs
description ioc process Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe -
outlook_win_path3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe
Reported IOCs
description ioc process Key opened \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe
Processes 2
-
C:\Users\Admin\AppData\Local\Temp\3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exePID:1084"C:\Users\Admin\AppData\Local\Temp\3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe"Suspicious use of SetThreadContextSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exePID:1656"C:\Users\Admin\AppData\Local\Temp\3a4fc42fdb5a73034c00e4d709dad5641ca8ec64c0684fa5ce5138551dd3f47a.exe"Accesses Microsoft Outlook profilesSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenoutlook_office_pathoutlook_win_path
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
00:00
00:00
Downloads
-
memory/1084-54-0x0000000001180000-0x000000000122A000-memory.dmp
-
memory/1084-55-0x0000000001180000-0x000000000122A000-memory.dmp
-
memory/1084-56-0x0000000000360000-0x0000000000361000-memory.dmp
-
memory/1656-62-0x000000000043772E-mapping.dmp
-
memory/1656-58-0x0000000000070000-0x00000000000AC000-memory.dmp
-
memory/1656-59-0x0000000000070000-0x00000000000AC000-memory.dmp
-
memory/1656-60-0x0000000000070000-0x00000000000AC000-memory.dmp
-
memory/1656-57-0x0000000000070000-0x00000000000AC000-memory.dmp
-
memory/1656-63-0x0000000000070000-0x00000000000AC000-memory.dmp
-
memory/1656-66-0x0000000000070000-0x00000000000AC000-memory.dmp
-
memory/1656-69-0x0000000000070000-0x00000000000AC000-memory.dmp
-
memory/1656-70-0x0000000000070000-0x00000000000AC000-memory.dmp
-
memory/1656-71-0x0000000000070000-0x00000000000AC000-memory.dmp
-
memory/1656-72-0x0000000000580000-0x0000000000581000-memory.dmp
-
memory/1656-73-0x0000000000581000-0x0000000000582000-memory.dmp
Title
Loading data