Analysis
-
max time kernel
122s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:38
Static task
static1
Behavioral task
behavioral1
Sample
Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe
Resource
win10v2004-20220414-en
General
-
Target
Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe
-
Size
403KB
-
MD5
d29da00b52dbed49aa1c3048be013aa8
-
SHA1
ea80dc07e833f7952d47705d239c99781ab7f0c3
-
SHA256
ff2c551213e1242069528d7ba1e6da50a36ab0f1c0ef0d972d341e08a736d8e4
-
SHA512
d1a621da52fa59b174606fa66ae5385b4c553e6610a134284c7f3fc48b890f9cb1e2f5d5c3ce3db55d2b2a2f42ffe2244a57535b6b08f9903797b316d0969433
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.martasmebeles.lv/ - Port:
21 - Username:
[email protected] - Password:
G$?eK%*r70t~
Protocol: ftp- Host:
ftp://ftp.martasmebeles.lv/ - Port:
21 - Username:
[email protected] - Password:
G$?eK%*r70t~
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/820-62-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/820-63-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/820-64-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/820-65-0x000000000044D55E-mapping.dmp family_agenttesla behavioral1/memory/820-67-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/820-69-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\IYLZX5 = "C:\\Users\\Admin\\AppData\\Roaming\\IYLZX5\\IYLZX5.exe" Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exedescription pid process target process PID 1668 set thread context of 820 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exeElectronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exepid process 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe 820 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe 820 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exeElectronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exedescription pid process Token: SeDebugPrivilege 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe Token: SeDebugPrivilege 820 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exepid process 820 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exeElectronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exedescription pid process target process PID 1668 wrote to memory of 1732 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe PID 1668 wrote to memory of 1732 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe PID 1668 wrote to memory of 1732 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe PID 1668 wrote to memory of 1732 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe PID 1668 wrote to memory of 820 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe PID 1668 wrote to memory of 820 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe PID 1668 wrote to memory of 820 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe PID 1668 wrote to memory of 820 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe PID 1668 wrote to memory of 820 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe PID 1668 wrote to memory of 820 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe PID 1668 wrote to memory of 820 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe PID 1668 wrote to memory of 820 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe PID 1668 wrote to memory of 820 1668 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe PID 820 wrote to memory of 1996 820 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe netsh.exe PID 820 wrote to memory of 1996 820 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe netsh.exe PID 820 wrote to memory of 1996 820 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe netsh.exe PID 820 wrote to memory of 1996 820 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe -
outlook_win_path 1 IoCs
Processes:
Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe"C:\Users\Admin\AppData\Local\Temp\Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe"C:\Users\Admin\AppData\Local\Temp\Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe"C:\Users\Admin\AppData\Local\Temp\Electronic TT Swift Maksajuma dokuments ar atru apstiprinajumu 9029938829 doc PDF.exe"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/820-64-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/820-65-0x000000000044D55E-mapping.dmp
-
memory/820-70-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/820-69-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/820-67-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/820-59-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/820-62-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/820-63-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/820-60-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1668-54-0x00000000001C0000-0x000000000022C000-memory.dmpFilesize
432KB
-
memory/1668-55-0x00000000004E0000-0x00000000004E8000-memory.dmpFilesize
32KB
-
memory/1668-58-0x0000000000B30000-0x0000000000B44000-memory.dmpFilesize
80KB
-
memory/1668-57-0x0000000000870000-0x0000000000886000-memory.dmpFilesize
88KB
-
memory/1668-56-0x00000000040C0000-0x0000000004110000-memory.dmpFilesize
320KB
-
memory/1996-71-0x0000000000000000-mapping.dmp