Analysis

  • max time kernel
    141s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 02:09

General

  • Target

    BANK DETAILS.exe

  • Size

    414KB

  • MD5

    e31fab9d8d4a78dd347a2386bb32349f

  • SHA1

    c9ca9f887d9d6e9de29201e203defd6bb62458c9

  • SHA256

    786be13603b06cce80fac1349c514e29ecd2664a51f045bc5446d2f9647087ec

  • SHA512

    3b3cd86d0067872b0375452020ecc2e3c6a9fb34a6ec741077ae5d680494b4c96fee890c57edb4cf828cb57e035ef6f0ed6683ef8c94fb1405647e10daf8ca59

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.pptoursperu.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    mailppt2019-

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload 1 IoCs
  • Disables Task Manager via registry modification
  • Drops file in Drivers directory 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BANK DETAILS.exe
    "C:\Users\Admin\AppData\Local\Temp\BANK DETAILS.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5060
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "{path}"
      2⤵
      • Drops file in Drivers directory
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:4688
      • C:\Windows\SysWOW64\REG.exe
        REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        3⤵
        • Modifies registry key
        PID:3000
      • C:\Windows\SysWOW64\netsh.exe
        "netsh" wlan show profile
        3⤵
          PID:4816
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1276
          3⤵
          • Program crash
          PID:2772
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4688 -ip 4688
      1⤵
        PID:5064

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3000-138-0x0000000000000000-mapping.dmp

      • memory/4688-135-0x0000000000000000-mapping.dmp

      • memory/4688-136-0x0000000000400000-0x0000000000450000-memory.dmp

        Filesize

        320KB

      • memory/4688-137-0x0000000006050000-0x00000000060B6000-memory.dmp

        Filesize

        408KB

      • memory/4688-139-0x00000000070D0000-0x0000000007120000-memory.dmp

        Filesize

        320KB

      • memory/4816-140-0x0000000000000000-mapping.dmp

      • memory/5060-130-0x0000000000C10000-0x0000000000C7E000-memory.dmp

        Filesize

        440KB

      • memory/5060-131-0x0000000005A40000-0x0000000005FE4000-memory.dmp

        Filesize

        5.6MB

      • memory/5060-132-0x0000000005530000-0x00000000055C2000-memory.dmp

        Filesize

        584KB

      • memory/5060-133-0x00000000054E0000-0x00000000054EA000-memory.dmp

        Filesize

        40KB

      • memory/5060-134-0x0000000008ED0000-0x0000000008F6C000-memory.dmp

        Filesize

        624KB