Analysis
-
max time kernel
95s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:16
Static task
static1
Behavioral task
behavioral1
Sample
scan-copy.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
scan-copy.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
scan-copy.exe
-
Size
595KB
-
MD5
0ac8b9e958f9fc143c114c1046a33241
-
SHA1
8310b20820a1f3f936dac349f3f97bae38a70324
-
SHA256
1fb2dc85595d9769b6d83c91875511e7b3e5a70df5dc2e561fd5c3dc0eab91c5
-
SHA512
a7fab37dc6a9f9b0ebb7d9820b5d5455d49045be101db8e4c4f92beb6583fc911c79cbe1b6fa501797b8dd1cfa2cdc017ac4d9489b179d088c98ed5d1fe5e29a
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
111aaa
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/108-62-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla behavioral1/memory/108-63-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla behavioral1/memory/108-64-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla behavioral1/memory/108-65-0x000000000044A73E-mapping.dmp family_agenttesla behavioral1/memory/108-67-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla behavioral1/memory/108-69-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
scan-copy.exedescription pid process target process PID 1260 set thread context of 108 1260 scan-copy.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
scan-copy.exeMSBuild.exepid process 1260 scan-copy.exe 108 MSBuild.exe 108 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
scan-copy.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 1260 scan-copy.exe Token: SeDebugPrivilege 108 MSBuild.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
scan-copy.exedescription pid process target process PID 1260 wrote to memory of 108 1260 scan-copy.exe MSBuild.exe PID 1260 wrote to memory of 108 1260 scan-copy.exe MSBuild.exe PID 1260 wrote to memory of 108 1260 scan-copy.exe MSBuild.exe PID 1260 wrote to memory of 108 1260 scan-copy.exe MSBuild.exe PID 1260 wrote to memory of 108 1260 scan-copy.exe MSBuild.exe PID 1260 wrote to memory of 108 1260 scan-copy.exe MSBuild.exe PID 1260 wrote to memory of 108 1260 scan-copy.exe MSBuild.exe PID 1260 wrote to memory of 108 1260 scan-copy.exe MSBuild.exe PID 1260 wrote to memory of 108 1260 scan-copy.exe MSBuild.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\scan-copy.exe"C:\Users\Admin\AppData\Local\Temp\scan-copy.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/108-64-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/108-59-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/108-60-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/108-62-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/108-63-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/108-65-0x000000000044A73E-mapping.dmp
-
memory/108-67-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/108-69-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1260-55-0x0000000075CE1000-0x0000000075CE3000-memory.dmpFilesize
8KB
-
memory/1260-56-0x00000000003A0000-0x00000000003AA000-memory.dmpFilesize
40KB
-
memory/1260-57-0x00000000026F0000-0x000000000275A000-memory.dmpFilesize
424KB
-
memory/1260-58-0x0000000000E50000-0x0000000000EA0000-memory.dmpFilesize
320KB
-
memory/1260-54-0x0000000000F20000-0x0000000000FBC000-memory.dmpFilesize
624KB