Analysis
-
max time kernel
133s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 22:44
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Purchase Order.exe
Resource
win10v2004-20220414-en
General
-
Target
Purchase Order.exe
-
Size
475KB
-
MD5
3daaba84ce640bfda2f7721ac24e8e32
-
SHA1
3d8ed4d6f598b796cef240e2696b7af988e06679
-
SHA256
04066d2aaa261814ebb764b76ec4977184b985cd0c56917145068aa37de50965
-
SHA512
71f69902f43be4e1c5fe0677f0c6021de6708bb0c76a43a78063fac2b0e0864e522ed1a0d0e3b944d5566409f4d6dd2332c62e4f803fd0f81f064d083fdfc1e1
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.capitalone-bank.org - Port:
587 - Username:
[email protected] - Password:
u)aHYn*7
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1088-62-0x0000000000400000-0x0000000000458000-memory.dmp family_agenttesla behavioral1/memory/1088-63-0x0000000000400000-0x0000000000458000-memory.dmp family_agenttesla behavioral1/memory/1088-64-0x0000000000400000-0x0000000000458000-memory.dmp family_agenttesla behavioral1/memory/1088-65-0x000000000045301E-mapping.dmp family_agenttesla behavioral1/memory/1088-67-0x0000000000400000-0x0000000000458000-memory.dmp family_agenttesla behavioral1/memory/1088-69-0x0000000000400000-0x0000000000458000-memory.dmp family_agenttesla -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Purchase Order.exedescription pid process target process PID 1064 set thread context of 1088 1064 Purchase Order.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Purchase Order.exeMSBuild.exepid process 1064 Purchase Order.exe 1064 Purchase Order.exe 1088 MSBuild.exe 1088 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Purchase Order.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 1064 Purchase Order.exe Token: SeDebugPrivilege 1088 MSBuild.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Purchase Order.exedescription pid process target process PID 1064 wrote to memory of 1088 1064 Purchase Order.exe MSBuild.exe PID 1064 wrote to memory of 1088 1064 Purchase Order.exe MSBuild.exe PID 1064 wrote to memory of 1088 1064 Purchase Order.exe MSBuild.exe PID 1064 wrote to memory of 1088 1064 Purchase Order.exe MSBuild.exe PID 1064 wrote to memory of 1088 1064 Purchase Order.exe MSBuild.exe PID 1064 wrote to memory of 1088 1064 Purchase Order.exe MSBuild.exe PID 1064 wrote to memory of 1088 1064 Purchase Order.exe MSBuild.exe PID 1064 wrote to memory of 1088 1064 Purchase Order.exe MSBuild.exe PID 1064 wrote to memory of 1088 1064 Purchase Order.exe MSBuild.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1064-54-0x0000000000F90000-0x000000000100C000-memory.dmpFilesize
496KB
-
memory/1064-55-0x00000000769D1000-0x00000000769D3000-memory.dmpFilesize
8KB
-
memory/1064-56-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/1064-57-0x0000000000EC0000-0x0000000000F24000-memory.dmpFilesize
400KB
-
memory/1064-58-0x0000000000A30000-0x0000000000A88000-memory.dmpFilesize
352KB
-
memory/1088-59-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1088-60-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1088-62-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1088-63-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1088-64-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1088-65-0x000000000045301E-mapping.dmp
-
memory/1088-67-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1088-69-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB