Analysis
- max time kernel
139s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
16/02/2022, 01:23
Static task
static1
Behavioral task
behavioral1
Sample
money.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
money.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target money.exe
- Size 599KB
- Sample220216-brs96abbd7
- SHA256 eb40b54b58e29dd636f8e568eec58fea042b1fa19ccca32b7e9b7ad576339cb7
- MD5 08cc35496adcfb97981927f59650f82c
- SHA1 2b4ec63daf5d7a8c089d488c4cb9c713914d9519
- SHA512 1e2713ea3d228197b7ed1c83024732ed27bda24b378106e9553152479e0eed8fc730244f4fe85cfae2ed8b704d6f73322e15872081cc3f21a2690dc32d92af12
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.dtvcambodia.com
-
Port
587
-
Username
-
Password
@DTVcambodia2017
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 1 IoCs
resource yara_rule behavioral2/memory/2432-138-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla - Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe - Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1496 set thread context of 2432 1496 money.exe 98 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1496 money.exe 1496 money.exe 1496 money.exe 1496 money.exe 1496 money.exe 2432 RegSvcs.exe 2432 RegSvcs.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2404 svchost.exe Token: SeCreatePagefilePrivilege 2404 svchost.exe Token: SeShutdownPrivilege 2404 svchost.exe Token: SeCreatePagefilePrivilege 2404 svchost.exe Token: SeShutdownPrivilege 2404 svchost.exe Token: SeCreatePagefilePrivilege 2404 svchost.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe Token: SeRestorePrivilege 3812 TiWorker.exe Token: SeSecurityPrivilege 3812 TiWorker.exe Token: SeBackupPrivilege 3812 TiWorker.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1496 wrote to memory of 3936 1496 money.exe 96 PID 1496 wrote to memory of 3936 1496 money.exe 96 PID 1496 wrote to memory of 3936 1496 money.exe 96 PID 1496 wrote to memory of 3868 1496 money.exe 97 PID 1496 wrote to memory of 3868 1496 money.exe 97 PID 1496 wrote to memory of 3868 1496 money.exe 97 PID 1496 wrote to memory of 2432 1496 money.exe 98 PID 1496 wrote to memory of 2432 1496 money.exe 98 PID 1496 wrote to memory of 2432 1496 money.exe 98 PID 1496 wrote to memory of 2432 1496 money.exe 98 PID 1496 wrote to memory of 2432 1496 money.exe 98 PID 1496 wrote to memory of 2432 1496 money.exe 98 PID 1496 wrote to memory of 2432 1496 money.exe 98 PID 1496 wrote to memory of 2432 1496 money.exe 98 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\money.exe"C:\Users\Admin\AppData\Local\Temp\money.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵PID:3936
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵PID:3868
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:2432
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3812