Analysis
-
max time kernel
131s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:20
General
-
Target
PI for requested order.exe
-
Size
478KB
-
MD5
2680584211be8d5fb93057892e31ce33
-
SHA1
0fa0c583d7fed58664f6bc6d419e7d0a107fb5fd
-
SHA256
0bec6071e5185a2b3ffc0656e33da316380c56c12e807da02c28f4acad4a2fce
-
SHA512
4f3bb4c0c7e77093649a908a38f56119f3e24c50298e2053b0eeae3606ffdf6580e1cc455267ca5e8759d0e48218342bb13da339085b82c8deded4ae018603b9
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.kohinoorribbon.com - Port:
587 - Username:
[email protected] - Password:
ashu@1976
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PI for requested order.exe"C:\Users\Admin\AppData\Local\Temp\PI for requested order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qYRRIiYSX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp933C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PI for requested order.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp933C.tmpFilesize
1KB
MD5d77569b6a5a9aecdfb6c51797da31e78
SHA14dee865fda65bddd451c3f6d275c47671340d9e2
SHA25668c3f2bab59112dba22a66a8e233ac94a1a4ba5b7f2702a8667722650a78eb34
SHA512441f49d47793ef1d4f4dcc0b179b391f1ae20c9e8ade7497980a506681cfcb9125343114daa2626373ef6f313c972e111398d34dbc4e28bcdcc9af4f2833be1d
-
memory/1512-57-0x00000000044D0000-0x0000000004536000-memory.dmpFilesize
408KB
-
memory/1512-56-0x0000000000260000-0x0000000000270000-memory.dmpFilesize
64KB
-
memory/1512-54-0x0000000000E40000-0x0000000000EBE000-memory.dmpFilesize
504KB
-
memory/1512-58-0x0000000000A60000-0x0000000000AAA000-memory.dmpFilesize
296KB
-
memory/1512-55-0x0000000076421000-0x0000000076423000-memory.dmpFilesize
8KB
-
memory/1708-59-0x0000000000000000-mapping.dmp
-
memory/1776-62-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1776-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1776-65-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1776-66-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1776-67-0x0000000000446CBE-mapping.dmp
-
memory/1776-64-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1776-69-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1776-71-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB