Analysis
- max time kernel
138s - max time network
134s - platform
windows7_x64 - resource
win7-20220414-en - submitted
20/05/2022, 23:51
General
- Target PO#68732.png.exe
- Size 2.8MB
- Sample220520-3we2waceam
- SHA256 7998ac3e684a8b86abc784ecfbce4a23a54166ef3a08d497a0288dc667c6f510
Malware Config
Extracted
-
C:\Users\Admin\AppData\Local\79FE0CC911\Log.txt
-
masslogger
- <|| v2.2.0.0 ||> User Name: Admin IP: 154.61.71.51 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 6:03:09 AM MassLogger Started: 5/21/2022 6:03:02 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\MassLoggerBin.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| USB Spread ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> NA
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.kaysarplastik.com
-
Port
587
-
Username
-
Password
abdullah123
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
- MassLogger Main Payload 4 IoCs
- MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
- AgentTesla Payload 4 IoCs
- Executes dropped EXE 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 4 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 32 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO#68732.png.exe"C:\Users\Admin\AppData\Local\Temp\PO#68732.png.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v foxy /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\foxy.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v foxy /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\foxy.exe"3⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\foxy.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\foxy.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\origiiiy.exe"C:\Users\Admin\AppData\Local\Temp\origiiiy.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MassLoggerBin.exe"C:\Users\Admin\AppData\Local\Temp\MassLoggerBin.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
InstallUtil.exe
InstallUtil.exe
MassLoggerBin.exe
MassLoggerBin.exe
origiiiy.exe
origiiiy.exe
foxy.exe
foxy.exe
InstallUtil.exe
MassLoggerBin.exe
origiiiy.exe
foxy.exe
memory/928-79-0x0000000075BA1000-0x0000000075BA3000-memory.dmp
memory/928-68-0x0000000000400000-0x0000000000562000-memory.dmp
memory/928-70-0x0000000000400000-0x0000000000562000-memory.dmp
memory/928-71-0x0000000000400000-0x0000000000562000-memory.dmp
memory/928-72-0x0000000000400000-0x0000000000562000-memory.dmp
memory/928-67-0x0000000000400000-0x0000000000562000-memory.dmp
memory/928-78-0x0000000000400000-0x0000000000562000-memory.dmp
memory/928-76-0x0000000000400000-0x0000000000562000-memory.dmp
memory/1548-84-0x00000000013A0000-0x00000000013EC000-memory.dmp
memory/1668-55-0x0000000000200000-0x000000000021E000-memory.dmp
memory/1668-54-0x0000000000AA0000-0x0000000000D68000-memory.dmp
memory/1668-56-0x0000000000280000-0x000000000028A000-memory.dmp
memory/1732-63-0x00000000011F0000-0x00000000014B8000-memory.dmp
memory/1732-64-0x00000000003C0000-0x00000000003CA000-memory.dmp
memory/1892-90-0x0000000000AC0000-0x0000000000B84000-memory.dmp
memory/1892-91-0x00000000020D0000-0x0000000002148000-memory.dmp
memory/1892-93-0x00000000004A5000-0x00000000004B6000-memory.dmp
memory/1892-94-0x00000000009C0000-0x00000000009D4000-memory.dmp