Analysis
-
max time kernel
135s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:40
Static task
static1
Behavioral task
behavioral1
Sample
Scan_INV0719.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Scan_INV0719.exe
Resource
win10v2004-20220414-en
General
-
Target
Scan_INV0719.exe
-
Size
795KB
-
MD5
97d445e3b07a19c03b0645affc4add14
-
SHA1
ebef5683355560d5463e66996cc2878f3670d678
-
SHA256
c4412b2563fa12f9cfb74a6c5f6cd63fa17afd15ef374cf846f3b808e9a01fb5
-
SHA512
3f0b772eb07a5d121ec2823811ce70e49f600571d07662aca2563d9f9821b588d5b37756008cdc920245a47f5e9acaba6fe750f6a886fce082fe3577912d0fd2
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2028-62-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/2028-63-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/2028-64-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/2028-65-0x00000000004475EE-mapping.dmp family_agenttesla behavioral1/memory/2028-68-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/2028-70-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Executes dropped EXE 1 IoCs
Processes:
InstallUtil.exepid process 2028 InstallUtil.exe -
Loads dropped DLL 1 IoCs
Processes:
Scan_INV0719.exepid process 960 Scan_INV0719.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/960-56-0x0000000000400000-0x000000000040A000-memory.dmp agile_net -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Scan_INV0719.exedescription pid process target process PID 960 set thread context of 2028 960 Scan_INV0719.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Scan_INV0719.exeInstallUtil.exepid process 960 Scan_INV0719.exe 960 Scan_INV0719.exe 960 Scan_INV0719.exe 2028 InstallUtil.exe 2028 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Scan_INV0719.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 960 Scan_INV0719.exe Token: SeDebugPrivilege 2028 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 2028 InstallUtil.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Scan_INV0719.exedescription pid process target process PID 960 wrote to memory of 2028 960 Scan_INV0719.exe InstallUtil.exe PID 960 wrote to memory of 2028 960 Scan_INV0719.exe InstallUtil.exe PID 960 wrote to memory of 2028 960 Scan_INV0719.exe InstallUtil.exe PID 960 wrote to memory of 2028 960 Scan_INV0719.exe InstallUtil.exe PID 960 wrote to memory of 2028 960 Scan_INV0719.exe InstallUtil.exe PID 960 wrote to memory of 2028 960 Scan_INV0719.exe InstallUtil.exe PID 960 wrote to memory of 2028 960 Scan_INV0719.exe InstallUtil.exe PID 960 wrote to memory of 2028 960 Scan_INV0719.exe InstallUtil.exe PID 960 wrote to memory of 2028 960 Scan_INV0719.exe InstallUtil.exe PID 960 wrote to memory of 2028 960 Scan_INV0719.exe InstallUtil.exe PID 960 wrote to memory of 2028 960 Scan_INV0719.exe InstallUtil.exe PID 960 wrote to memory of 2028 960 Scan_INV0719.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Scan_INV0719.exe"C:\Users\Admin\AppData\Local\Temp\Scan_INV0719.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:2028
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
memory/960-54-0x00000000013B0000-0x000000000147C000-memory.dmpFilesize
816KB
-
memory/960-55-0x00000000003D0000-0x00000000003EE000-memory.dmpFilesize
120KB
-
memory/960-56-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/960-57-0x0000000000990000-0x000000000099A000-memory.dmpFilesize
40KB
-
memory/2028-63-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2028-62-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2028-64-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2028-65-0x00000000004475EE-mapping.dmp
-
memory/2028-60-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2028-68-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2028-70-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2028-59-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2028-72-0x0000000076571000-0x0000000076573000-memory.dmpFilesize
8KB