Analysis
-
max time kernel
127s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 22:54
Static task
static1
Behavioral task
behavioral1
Sample
yevIa4Z99KSppE9.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
yevIa4Z99KSppE9.exe
Resource
win10v2004-20220414-en
General
-
Target
yevIa4Z99KSppE9.exe
-
Size
423KB
-
MD5
aa7bc1c91e5d0436578c580662fc3253
-
SHA1
76d62a638598aaf315030c3f8c21afff1b0a6cb1
-
SHA256
a9a90e322d043cf6430fb070d2cf81ea38b36b174add5b06c3d8691c6c605949
-
SHA512
f854405a1a22d1e7d6ada376efc5550706d29239855c97b98d6696e04f85fb14d6fd732b9339e7c5c52ffe0b282111ee2669b7606ec75cf4b843fae9ca1b85d0
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
Mold4lord231
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/556-61-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/556-62-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/556-63-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/556-64-0x0000000000446C8E-mapping.dmp family_agenttesla behavioral1/memory/556-66-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/556-68-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
yevIa4Z99KSppE9.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yevIa4Z99KSppE9.exe Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yevIa4Z99KSppE9.exe Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yevIa4Z99KSppE9.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
yevIa4Z99KSppE9.exedescription pid process target process PID 1640 set thread context of 556 1640 yevIa4Z99KSppE9.exe yevIa4Z99KSppE9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
yevIa4Z99KSppE9.exepid process 556 yevIa4Z99KSppE9.exe 556 yevIa4Z99KSppE9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
yevIa4Z99KSppE9.exedescription pid process Token: SeDebugPrivilege 556 yevIa4Z99KSppE9.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
yevIa4Z99KSppE9.exepid process 556 yevIa4Z99KSppE9.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
yevIa4Z99KSppE9.exedescription pid process target process PID 1640 wrote to memory of 988 1640 yevIa4Z99KSppE9.exe schtasks.exe PID 1640 wrote to memory of 988 1640 yevIa4Z99KSppE9.exe schtasks.exe PID 1640 wrote to memory of 988 1640 yevIa4Z99KSppE9.exe schtasks.exe PID 1640 wrote to memory of 988 1640 yevIa4Z99KSppE9.exe schtasks.exe PID 1640 wrote to memory of 556 1640 yevIa4Z99KSppE9.exe yevIa4Z99KSppE9.exe PID 1640 wrote to memory of 556 1640 yevIa4Z99KSppE9.exe yevIa4Z99KSppE9.exe PID 1640 wrote to memory of 556 1640 yevIa4Z99KSppE9.exe yevIa4Z99KSppE9.exe PID 1640 wrote to memory of 556 1640 yevIa4Z99KSppE9.exe yevIa4Z99KSppE9.exe PID 1640 wrote to memory of 556 1640 yevIa4Z99KSppE9.exe yevIa4Z99KSppE9.exe PID 1640 wrote to memory of 556 1640 yevIa4Z99KSppE9.exe yevIa4Z99KSppE9.exe PID 1640 wrote to memory of 556 1640 yevIa4Z99KSppE9.exe yevIa4Z99KSppE9.exe PID 1640 wrote to memory of 556 1640 yevIa4Z99KSppE9.exe yevIa4Z99KSppE9.exe PID 1640 wrote to memory of 556 1640 yevIa4Z99KSppE9.exe yevIa4Z99KSppE9.exe -
outlook_office_path 1 IoCs
Processes:
yevIa4Z99KSppE9.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yevIa4Z99KSppE9.exe -
outlook_win_path 1 IoCs
Processes:
yevIa4Z99KSppE9.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 yevIa4Z99KSppE9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\yevIa4Z99KSppE9.exe"C:\Users\Admin\AppData\Local\Temp\yevIa4Z99KSppE9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kNUwplUJIJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD4AE.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\yevIa4Z99KSppE9.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD4AE.tmpFilesize
1KB
MD5e14c512e591f7d8a5f2d8f778638f2ba
SHA1d7a9609aab9ebf14edebb5fd279721b179b97011
SHA256343505af8b316ee983af16a95aae9f24dd44e2903bf406600b672177ffe2ddb3
SHA512184c9ae09dcd9eaa60f64f7104d00012836b90c8f27c2fd04f3aa929e51cf86b3b5630379995016b62bd34f920df961f65bed08a4e06c708b8d98d1d35ffc9a8
-
memory/556-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/556-58-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/556-59-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/556-62-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/556-63-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/556-64-0x0000000000446C8E-mapping.dmp
-
memory/556-66-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/556-68-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/556-70-0x00000000745C0000-0x0000000074B6B000-memory.dmpFilesize
5.7MB
-
memory/988-56-0x0000000000000000-mapping.dmp
-
memory/1640-55-0x00000000745C0000-0x0000000074B6B000-memory.dmpFilesize
5.7MB
-
memory/1640-54-0x0000000076241000-0x0000000076243000-memory.dmpFilesize
8KB