Analysis
-
max time kernel
183s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 02:27
Static task
static1
Behavioral task
behavioral1
Sample
Swift.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Swift.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
Swift.exe
-
Size
385KB
-
MD5
5a4e899e1f72d8036da67d3840d24a89
-
SHA1
138d2f78425306696c78f22d4ee83323f6af7a10
-
SHA256
3080bf75b34e9b440154d8f35f7e8c5bd111995869118a093f81b56583f7c03b
-
SHA512
9bd07135e613239c980418e703e4655a6239119dea0373188b0e6847dfe0e034726e1c3274aabe1cda5d855857dd9da08e8614b379fd4de0ab0728c16a270d45
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
js}$_IlwF1q4
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4412-133-0x0000000000400000-0x000000000044A000-memory.dmp family_agenttesla -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Swift.exedescription pid process target process PID 3320 set thread context of 4412 3320 Swift.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Swift.exeRegSvcs.exepid process 3320 Swift.exe 3320 Swift.exe 3320 Swift.exe 4412 RegSvcs.exe 4412 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Swift.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 3320 Swift.exe Token: SeDebugPrivilege 4412 RegSvcs.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Swift.exedescription pid process target process PID 3320 wrote to memory of 4440 3320 Swift.exe RegSvcs.exe PID 3320 wrote to memory of 4440 3320 Swift.exe RegSvcs.exe PID 3320 wrote to memory of 4440 3320 Swift.exe RegSvcs.exe PID 3320 wrote to memory of 4412 3320 Swift.exe RegSvcs.exe PID 3320 wrote to memory of 4412 3320 Swift.exe RegSvcs.exe PID 3320 wrote to memory of 4412 3320 Swift.exe RegSvcs.exe PID 3320 wrote to memory of 4412 3320 Swift.exe RegSvcs.exe PID 3320 wrote to memory of 4412 3320 Swift.exe RegSvcs.exe PID 3320 wrote to memory of 4412 3320 Swift.exe RegSvcs.exe PID 3320 wrote to memory of 4412 3320 Swift.exe RegSvcs.exe PID 3320 wrote to memory of 4412 3320 Swift.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swift.exe"C:\Users\Admin\AppData\Local\Temp\Swift.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3320-130-0x00000000746A0000-0x0000000074C51000-memory.dmpFilesize
5.7MB
-
memory/4412-132-0x0000000000000000-mapping.dmp
-
memory/4412-133-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/4412-134-0x00000000746A0000-0x0000000074C51000-memory.dmpFilesize
5.7MB
-
memory/4440-131-0x0000000000000000-mapping.dmp