Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 23:16
Static task
static1
Behavioral task
behavioral1
Sample
Po129834589.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Po129834589.exe
Resource
win10v2004-20220414-en
General
-
Target
Po129834589.exe
-
Size
743KB
-
MD5
7f90e73a8d12d33684f6d254c3d84ea6
-
SHA1
3ebaacc513549648b86fa343adbfb1cb53d60144
-
SHA256
5cc60b79a462acba33bafc299e15f4b0e8f75a96944f2dd3dd0836cb305bd889
-
SHA512
aa0faa674be25e8c1392d09c8409a61a310208adb7f33f03eecac6e326b4bd3137b866fed7cbd087292308e470088dc5279d484107aefac2bf5ae7ea079adbae
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mytravelexplorer.com - Port:
587 - Username:
[email protected] - Password:
$g=!lt#SakbA
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3644-136-0x0000000000400000-0x0000000000458000-memory.dmp family_agenttesla -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Po129834589.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation Po129834589.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Po129834589.exedescription pid process target process PID 3040 set thread context of 3644 3040 Po129834589.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
Po129834589.exeRegSvcs.exepid process 3040 Po129834589.exe 3040 Po129834589.exe 3040 Po129834589.exe 3040 Po129834589.exe 3040 Po129834589.exe 3644 RegSvcs.exe 3644 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Po129834589.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 3040 Po129834589.exe Token: SeDebugPrivilege 3644 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 3644 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Po129834589.exedescription pid process target process PID 3040 wrote to memory of 1912 3040 Po129834589.exe schtasks.exe PID 3040 wrote to memory of 1912 3040 Po129834589.exe schtasks.exe PID 3040 wrote to memory of 1912 3040 Po129834589.exe schtasks.exe PID 3040 wrote to memory of 3452 3040 Po129834589.exe RegSvcs.exe PID 3040 wrote to memory of 3452 3040 Po129834589.exe RegSvcs.exe PID 3040 wrote to memory of 3452 3040 Po129834589.exe RegSvcs.exe PID 3040 wrote to memory of 3388 3040 Po129834589.exe RegSvcs.exe PID 3040 wrote to memory of 3388 3040 Po129834589.exe RegSvcs.exe PID 3040 wrote to memory of 3388 3040 Po129834589.exe RegSvcs.exe PID 3040 wrote to memory of 3644 3040 Po129834589.exe RegSvcs.exe PID 3040 wrote to memory of 3644 3040 Po129834589.exe RegSvcs.exe PID 3040 wrote to memory of 3644 3040 Po129834589.exe RegSvcs.exe PID 3040 wrote to memory of 3644 3040 Po129834589.exe RegSvcs.exe PID 3040 wrote to memory of 3644 3040 Po129834589.exe RegSvcs.exe PID 3040 wrote to memory of 3644 3040 Po129834589.exe RegSvcs.exe PID 3040 wrote to memory of 3644 3040 Po129834589.exe RegSvcs.exe PID 3040 wrote to memory of 3644 3040 Po129834589.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Po129834589.exe"C:\Users\Admin\AppData\Local\Temp\Po129834589.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZHDXVlzIyQQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAAE6.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpAAE6.tmpFilesize
1KB
MD5c7a3272d0f6ce278426772da2af4b3d4
SHA1026946249afc789d6952a6f771a5d95671b58681
SHA256c68b63cf62fbc4e3f5e5501d5714850a54ebf9c343a312deafbd1d26469f85dc
SHA5128fa215bad93ba141e61cbd11129c879bd5fdbe31ca9eb0de11df7582a6f81094ea9ad6876d1e04f89c403f7f31db7ca5b0733cc1640b7f61d519a0308551a437
-
memory/1912-131-0x0000000000000000-mapping.dmp
-
memory/3040-130-0x0000000074F90000-0x0000000075541000-memory.dmpFilesize
5.7MB
-
memory/3388-134-0x0000000000000000-mapping.dmp
-
memory/3452-133-0x0000000000000000-mapping.dmp
-
memory/3644-135-0x0000000000000000-mapping.dmp
-
memory/3644-136-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/3644-137-0x0000000074F90000-0x0000000075541000-memory.dmpFilesize
5.7MB