Analysis
-
max time kernel
130s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:38
General
-
Target
Purchase order - products listing.exe
-
Size
341KB
-
MD5
86170f4ae6169a75285ab2f425773c5f
-
SHA1
2bf793b6ea03f3841753b4e87c075b0bb92400f8
-
SHA256
330e6f2570ed6549af122ac6fbaa1ebbe4372471fa8e1c671371ba46186ee76d
-
SHA512
ed2e90daf20f952714f7d02a0dae5173bb83664307e52de8caf86aa3322c60fa97d7487d2a8bef4c14f73cefb438e30b67977c71e31258b3ebd27470116b3ac5
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.daiphatfood.com.vn - Port:
587 - Username:
[email protected] - Password:
jn&6kG~_w;;A
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase order - products listing.exe"C:\Users\Admin\AppData\Local\Temp\Purchase order - products listing.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\atJKBynLysHFb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1585.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Purchase order - products listing.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1585.tmpFilesize
1KB
MD5a015d799596b16f6b534aa51ffe42aa5
SHA1a131de9a7af4eab00caabfa9a800644506470c08
SHA2567c59ea4db5931f99e73594ef789381524a9f72e5668a966099fbbf13a7e7c44b
SHA5120629a4e40381d6db1dee314ffb5b7ff6a4bec5e23a7d1313c62d6aed8fa15690778e620c5f316a434915f861bd6021f0f9d0b097d8b2969fd781f964612a35d4
-
memory/1188-58-0x0000000000000000-mapping.dmp
-
memory/1408-64-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1408-60-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1408-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1408-63-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1408-65-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1408-66-0x0000000000446BAE-mapping.dmp
-
memory/1408-68-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1408-70-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1468-57-0x0000000004D10000-0x0000000004D64000-memory.dmpFilesize
336KB
-
memory/1468-56-0x00000000004C0000-0x00000000004C8000-memory.dmpFilesize
32KB
-
memory/1468-55-0x00000000752D1000-0x00000000752D3000-memory.dmpFilesize
8KB
-
memory/1468-54-0x0000000000300000-0x000000000035C000-memory.dmpFilesize
368KB