Analysis
- max time kernel
133s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
11/01/2022, 12:08
General
- Target facturas.exe
- Size 414KB
- Sample220111-pawkvafgdk
- SHA256 d61623b9915cd46b51b99358c8d7fcbff16d1fed253dfba5372ffc7300f2577f
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.mincro.es
-
Port
587
-
Username
-
Password
OcM58913030
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 4 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\facturas.exe"C:\Users\Admin\AppData\Local\Temp\facturas.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VLChRBFYkfojU.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VLChRBFYkfojU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp33AE.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\facturas.exe"C:\Users\Admin\AppData\Local\Temp\facturas.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2032-381-0x0000000006120000-0x0000000006138000-memory.dmp
memory/2032-137-0x0000000005640000-0x00000000056DC000-memory.dmp
memory/2032-134-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2032-143-0x0000000005430000-0x000000000592E000-memory.dmp
memory/2032-136-0x0000000005930000-0x0000000005E2E000-memory.dmp
memory/2032-133-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2032-389-0x00000000065A0000-0x00000000065AA000-memory.dmp
memory/2032-131-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2032-382-0x00000000061B0000-0x0000000006216000-memory.dmp
memory/2032-390-0x0000000005430000-0x000000000592E000-memory.dmp
memory/2032-388-0x00000000066F0000-0x0000000006782000-memory.dmp
memory/2700-117-0x0000000005B10000-0x000000000600E000-memory.dmp
memory/2700-116-0x0000000000BC0000-0x0000000000C2E000-memory.dmp
memory/2700-115-0x0000000000BC0000-0x0000000000C2E000-memory.dmp
memory/2700-124-0x0000000007CA0000-0x0000000007D10000-memory.dmp
memory/2700-123-0x0000000007C00000-0x0000000007C9C000-memory.dmp
memory/2700-122-0x0000000005610000-0x0000000005B0E000-memory.dmp
memory/2700-121-0x0000000005790000-0x00000000057DB000-memory.dmp
memory/2700-120-0x00000000055F0000-0x00000000055FE000-memory.dmp
memory/2700-119-0x0000000005450000-0x000000000545A000-memory.dmp
memory/2700-118-0x00000000054D0000-0x0000000005562000-memory.dmp
memory/3380-142-0x0000000006A82000-0x0000000006A83000-memory.dmp
memory/3380-162-0x00000000079E0000-0x0000000007A46000-memory.dmp
memory/3380-140-0x00000000079E0000-0x0000000007A46000-memory.dmp
memory/3380-141-0x0000000006A80000-0x0000000006A81000-memory.dmp
memory/3380-138-0x00000000076F0000-0x0000000007712000-memory.dmp
memory/3380-135-0x00000000070C0000-0x00000000076E8000-memory.dmp
memory/3380-144-0x0000000007AE0000-0x0000000007E30000-memory.dmp
memory/3380-145-0x0000000007850000-0x000000000786C000-memory.dmp
memory/3380-146-0x0000000007E70000-0x0000000007EBB000-memory.dmp
memory/3380-147-0x00000000081F0000-0x0000000008266000-memory.dmp
memory/3380-148-0x0000000004510000-0x0000000004511000-memory.dmp
memory/3380-156-0x00000000070C0000-0x00000000076E8000-memory.dmp
memory/3380-157-0x000000007F160000-0x000000007F161000-memory.dmp
memory/3380-158-0x0000000009210000-0x0000000009243000-memory.dmp
memory/3380-159-0x0000000009210000-0x0000000009243000-memory.dmp
memory/3380-161-0x0000000007790000-0x00000000077F6000-memory.dmp
memory/3380-160-0x00000000076F0000-0x0000000007712000-memory.dmp
memory/3380-139-0x0000000007790000-0x00000000077F6000-memory.dmp
memory/3380-164-0x00000000081F0000-0x0000000008266000-memory.dmp
memory/3380-163-0x0000000007E70000-0x0000000007EBB000-memory.dmp
memory/3380-165-0x0000000008FD0000-0x0000000008FEE000-memory.dmp
memory/3380-170-0x0000000009340000-0x00000000093E5000-memory.dmp
memory/3380-171-0x0000000009510000-0x00000000095A4000-memory.dmp
memory/3380-202-0x0000000006A83000-0x0000000006A84000-memory.dmp
memory/3380-365-0x00000000094A0000-0x00000000094BA000-memory.dmp
memory/3380-370-0x00000000094A0000-0x00000000094BA000-memory.dmp
memory/3380-371-0x0000000009490000-0x0000000009498000-memory.dmp
memory/3380-376-0x0000000009490000-0x0000000009498000-memory.dmp
memory/3380-130-0x0000000004620000-0x0000000004656000-memory.dmp
memory/3380-128-0x0000000004510000-0x0000000004511000-memory.dmp
memory/3380-127-0x0000000004510000-0x0000000004511000-memory.dmp