Analysis
-
max time kernel
111s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:01
General
-
Target
PO Bailey Trading.exe
-
Size
482KB
-
MD5
2c4badcf417f3eb10daa56faf8931e51
-
SHA1
03a1693629b4b1b5b10380383549016fed01a418
-
SHA256
34b139e4a330ce4ae1572f70947218d40d0cf00864bc23ed41d02648966344db
-
SHA512
d622708afcd7e7458846a1143ecf2a444ec7722c4f3e5b0a6bf436383a235d446c4db726129998fd1a3d07f1393bfb1f8da978de01a2d0adc2560c4107a6b69e
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pierreinsurancebrokers.com - Port:
587 - Username:
[email protected] - Password:
advisor@1234
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO Bailey Trading.exe"C:\Users\Admin\AppData\Local\Temp\PO Bailey Trading.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EKGvgEymh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9712.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO Bailey Trading.exe"C:\Users\Admin\AppData\Local\Temp\PO Bailey Trading.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9712.tmpFilesize
1KB
MD502ed5b16c529b3fcec65f770c4fd0880
SHA106a8938ad9a100f5bbc5d97fdba445dc74627269
SHA256b4c1b434693b0394e5fc60a7b2d2856b4a75ed85139f10a48d4c5a2760a8c87e
SHA5122f94e7d93a4527879977a98f5f3214f4903e8e08aa436fbb2d69af7134e586f9c0a60fe06fc300220ba4dc040c7ba0e2be716018e9b840c7a0248d4613704987
-
memory/1208-56-0x0000000000000000-mapping.dmp
-
memory/1732-54-0x00000000755C1000-0x00000000755C3000-memory.dmpFilesize
8KB
-
memory/1732-55-0x0000000074640000-0x0000000074BEB000-memory.dmpFilesize
5.7MB
-
memory/2024-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2024-59-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2024-58-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2024-62-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2024-64-0x0000000000446C5E-mapping.dmp
-
memory/2024-63-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2024-66-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2024-68-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2024-70-0x0000000074640000-0x0000000074BEB000-memory.dmpFilesize
5.7MB