Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
17/02/2022, 07:02
Static task
static1
Behavioral task
behavioral1
Sample
OKWZcZcmCvIE09W.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
OKWZcZcmCvIE09W.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target OKWZcZcmCvIE09W.exe
- Size 875KB
- Sample220217-htsvqsada4
- SHA256 31a3c2f298b8b235303ecdcbe989f24ddda02a2da072c78cb0c6d0f8e9cd282a
- MD5 e9229ff99b468546cbc0f850933a01a5
- SHA1 d891329d0e3e669fc24c1cb9876c20e4a031d159
- SHA512 d07d7fa9eaa846c022c42dd8154794831528d6dc7fad383e35d96d80d07857191639fabd058e90dff2e872943ad83bb344cbd8dfbed3264a14c4bff55be5c732
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.pas-shipping.com
-
Port
587
-
Username
-
Password
Chik@kerdiamoo1400
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 1 IoCs
resource yara_rule behavioral2/memory/1496-139-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla - Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe - Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tKZVPq = "C:\\Users\\Admin\\AppData\\Roaming\\tKZVPq\\tKZVPq.exe" RegSvcs.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4300 set thread context of 1496 4300 OKWZcZcmCvIE09W.exe 101 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4300 OKWZcZcmCvIE09W.exe 4300 OKWZcZcmCvIE09W.exe 1496 RegSvcs.exe 1496 RegSvcs.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2152 svchost.exe Token: SeCreatePagefilePrivilege 2152 svchost.exe Token: SeShutdownPrivilege 2152 svchost.exe Token: SeCreatePagefilePrivilege 2152 svchost.exe Token: SeShutdownPrivilege 2152 svchost.exe Token: SeCreatePagefilePrivilege 2152 svchost.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe Token: SeRestorePrivilege 4796 TiWorker.exe Token: SeSecurityPrivilege 4796 TiWorker.exe Token: SeBackupPrivilege 4796 TiWorker.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4300 wrote to memory of 1496 4300 OKWZcZcmCvIE09W.exe 101 PID 4300 wrote to memory of 1496 4300 OKWZcZcmCvIE09W.exe 101 PID 4300 wrote to memory of 1496 4300 OKWZcZcmCvIE09W.exe 101 PID 4300 wrote to memory of 1496 4300 OKWZcZcmCvIE09W.exe 101 PID 4300 wrote to memory of 1496 4300 OKWZcZcmCvIE09W.exe 101 PID 4300 wrote to memory of 1496 4300 OKWZcZcmCvIE09W.exe 101 PID 4300 wrote to memory of 1496 4300 OKWZcZcmCvIE09W.exe 101 PID 4300 wrote to memory of 1496 4300 OKWZcZcmCvIE09W.exe 101 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\OKWZcZcmCvIE09W.exe"C:\Users\Admin\AppData\Local\Temp\OKWZcZcmCvIE09W.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:1496
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4796