Analysis
- max time kernel
164s - max time network
178s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
31/01/2022, 01:27
General
- Target Invoice Copy--SS21-22185.exe
- Size 422KB
- Sample220131-bt45fadhd5
- SHA256 f1335ff8e76a4d11bada8c19b7ee4dd47ebe2fa6893ab0a37c53e161a50f10f8
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.scsgroups.com
-
Port
587
-
Username
-
Password
Scs@sales#123
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- AgentTesla Payload 1 IoCs
- Drops file in Drivers directory 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice Copy--SS21-22185.exe"C:\Users\Admin\AppData\Local\Temp\Invoice Copy--SS21-22185.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3344-115-0x0000000000EE0000-0x0000000000F50000-memory.dmp
memory/3344-116-0x00000000031C0000-0x00000000031C1000-memory.dmp
memory/3344-117-0x0000000005930000-0x00000000059CC000-memory.dmp
memory/3344-118-0x0000000005740000-0x000000000574A000-memory.dmp
memory/3344-119-0x00000000059D0000-0x0000000005A62000-memory.dmp
memory/3344-120-0x0000000006110000-0x0000000006192000-memory.dmp
memory/3344-121-0x0000000008510000-0x000000000854C000-memory.dmp
memory/3976-122-0x0000000000400000-0x000000000043C000-memory.dmp
memory/3976-123-0x00000000055E0000-0x0000000005ADE000-memory.dmp
memory/3976-124-0x00000000050E0000-0x00000000055DE000-memory.dmp
memory/3976-125-0x0000000005D20000-0x0000000005D38000-memory.dmp
memory/3976-126-0x0000000005DC0000-0x0000000005E26000-memory.dmp
memory/3976-127-0x0000000001130000-0x000000000113A000-memory.dmp