Analysis
-
max time kernel
140s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 23:35
Static task
static1
Behavioral task
behavioral1
Sample
a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe
Resource
win10v2004-20220414-en
General
-
Target
a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe
-
Size
1.4MB
-
MD5
eca512d5289783f13b346958c0bca5d9
-
SHA1
061f5375c5edd832c9d6e9dcfa0a8733e1295dd0
-
SHA256
a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac
-
SHA512
20dc0f2ef11432cf63350b182f01c668d206a583473643932e4d2656f8f9f1932385bf14abed862e26ccb3f3919a703aeb562cea4d490cd877ed052d88c307f7
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
chisom6474
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3188-133-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe -
Drops startup file 1 IoCs
Processes:
a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PerceptionSimulationInput.url a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exedescription pid process target process PID 3124 set thread context of 3188 3124 a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2748 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 3188 RegSvcs.exe 3188 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exepid process 3124 a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 3188 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exepid process 3124 a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe 3124 a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe 3124 a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exepid process 3124 a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe 3124 a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe 3124 a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 3188 RegSvcs.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.execmd.exedescription pid process target process PID 3124 wrote to memory of 3188 3124 a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe RegSvcs.exe PID 3124 wrote to memory of 3188 3124 a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe RegSvcs.exe PID 3124 wrote to memory of 3188 3124 a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe RegSvcs.exe PID 3124 wrote to memory of 3188 3124 a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe RegSvcs.exe PID 3124 wrote to memory of 4568 3124 a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe cmd.exe PID 3124 wrote to memory of 4568 3124 a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe cmd.exe PID 3124 wrote to memory of 4568 3124 a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe cmd.exe PID 4568 wrote to memory of 2748 4568 cmd.exe timeout.exe PID 4568 wrote to memory of 2748 4568 cmd.exe timeout.exe PID 4568 wrote to memory of 2748 4568 cmd.exe timeout.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe"C:\Users\Admin\AppData\Local\Temp\a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:3188 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TimeOut 1 & Del /F "C:\Users\Admin\AppData\Local\Temp\a948c3fb252ee14db710de435d1dc5f88d0923e6e4eb20fade67aaf5e2e425ac.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\timeout.exeTimeOut 13⤵
- Delays execution with timeout.exe
PID:2748
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2748-137-0x0000000000000000-mapping.dmp
-
memory/3124-130-0x0000000003AD0000-0x0000000003B5E000-memory.dmpFilesize
568KB
-
memory/3124-131-0x0000000004870000-0x00000000048FE000-memory.dmpFilesize
568KB
-
memory/3188-132-0x0000000000000000-mapping.dmp
-
memory/3188-133-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3188-134-0x0000000005B70000-0x0000000006114000-memory.dmpFilesize
5.6MB
-
memory/3188-136-0x0000000005340000-0x00000000053D2000-memory.dmpFilesize
584KB
-
memory/3188-138-0x0000000005660000-0x00000000056FC000-memory.dmpFilesize
624KB
-
memory/3188-139-0x0000000006120000-0x0000000006186000-memory.dmpFilesize
408KB
-
memory/3188-140-0x0000000006380000-0x000000000638A000-memory.dmpFilesize
40KB
-
memory/4568-135-0x0000000000000000-mapping.dmp