Analysis
-
max time kernel
57s -
max time network
61s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 08:05
Static task
static1
Behavioral task
behavioral1
Sample
PO fcl 20'HOC0039119xlx.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO fcl 20'HOC0039119xlx.exe
Resource
win10v2004-20220414-en
General
-
Target
PO fcl 20'HOC0039119xlx.exe
-
Size
886KB
-
MD5
eb47bbd112cece167cfde57fbf70c2d9
-
SHA1
cd34c36c3b2c35d68ad6ae4db4ca47286d50915f
-
SHA256
740cdbd68d1d3705021e8b857f177c39938aa485f561ec1c208264d7d4ee5927
-
SHA512
0c5c2ad6f1c3d3496126a1b418e9afcf28d846ed2506175e19a84a1cb48d228d2bf692db129ce778a4b3102216da133af0bc8712c6e758a6624f85dd5bc7cf57
Malware Config
Extracted
Protocol: smtp- Host:
mail.topfrozenfoodbrand.com - Port:
587 - Username:
[email protected] - Password:
Everest10purch
Extracted
agenttesla
Protocol: smtp- Host:
mail.topfrozenfoodbrand.com - Port:
587 - Username:
[email protected] - Password:
Everest10purch - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops file in Drivers directory 1 IoCs
Processes:
PO fcl 20'HOC0039119xlx.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts PO fcl 20'HOC0039119xlx.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
PO fcl 20'HOC0039119xlx.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO fcl 20'HOC0039119xlx.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO fcl 20'HOC0039119xlx.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO fcl 20'HOC0039119xlx.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO fcl 20'HOC0039119xlx.exedescription pid process target process PID 2040 set thread context of 1540 2040 PO fcl 20'HOC0039119xlx.exe PO fcl 20'HOC0039119xlx.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1144 1540 WerFault.exe PO fcl 20'HOC0039119xlx.exe -
Processes:
PO fcl 20'HOC0039119xlx.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 PO fcl 20'HOC0039119xlx.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 PO fcl 20'HOC0039119xlx.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
PO fcl 20'HOC0039119xlx.exepid process 1540 PO fcl 20'HOC0039119xlx.exe 1540 PO fcl 20'HOC0039119xlx.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PO fcl 20'HOC0039119xlx.exedescription pid process Token: SeDebugPrivilege 1540 PO fcl 20'HOC0039119xlx.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
PO fcl 20'HOC0039119xlx.exePO fcl 20'HOC0039119xlx.exedescription pid process target process PID 2040 wrote to memory of 1540 2040 PO fcl 20'HOC0039119xlx.exe PO fcl 20'HOC0039119xlx.exe PID 2040 wrote to memory of 1540 2040 PO fcl 20'HOC0039119xlx.exe PO fcl 20'HOC0039119xlx.exe PID 2040 wrote to memory of 1540 2040 PO fcl 20'HOC0039119xlx.exe PO fcl 20'HOC0039119xlx.exe PID 2040 wrote to memory of 1540 2040 PO fcl 20'HOC0039119xlx.exe PO fcl 20'HOC0039119xlx.exe PID 2040 wrote to memory of 1540 2040 PO fcl 20'HOC0039119xlx.exe PO fcl 20'HOC0039119xlx.exe PID 2040 wrote to memory of 1540 2040 PO fcl 20'HOC0039119xlx.exe PO fcl 20'HOC0039119xlx.exe PID 2040 wrote to memory of 1540 2040 PO fcl 20'HOC0039119xlx.exe PO fcl 20'HOC0039119xlx.exe PID 2040 wrote to memory of 1540 2040 PO fcl 20'HOC0039119xlx.exe PO fcl 20'HOC0039119xlx.exe PID 2040 wrote to memory of 1540 2040 PO fcl 20'HOC0039119xlx.exe PO fcl 20'HOC0039119xlx.exe PID 1540 wrote to memory of 1144 1540 PO fcl 20'HOC0039119xlx.exe WerFault.exe PID 1540 wrote to memory of 1144 1540 PO fcl 20'HOC0039119xlx.exe WerFault.exe PID 1540 wrote to memory of 1144 1540 PO fcl 20'HOC0039119xlx.exe WerFault.exe PID 1540 wrote to memory of 1144 1540 PO fcl 20'HOC0039119xlx.exe WerFault.exe -
outlook_office_path 1 IoCs
Processes:
PO fcl 20'HOC0039119xlx.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO fcl 20'HOC0039119xlx.exe -
outlook_win_path 1 IoCs
Processes:
PO fcl 20'HOC0039119xlx.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO fcl 20'HOC0039119xlx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO fcl 20'HOC0039119xlx.exe"C:\Users\Admin\AppData\Local\Temp\PO fcl 20'HOC0039119xlx.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO fcl 20'HOC0039119xlx.exe"C:\Users\Admin\AppData\Local\Temp\PO fcl 20'HOC0039119xlx.exe"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 16883⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1144-71-0x0000000000000000-mapping.dmp
-
memory/1540-64-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1540-59-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1540-60-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1540-62-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1540-63-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1540-65-0x000000000043605E-mapping.dmp
-
memory/1540-67-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1540-69-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2040-56-0x0000000000270000-0x000000000027A000-memory.dmpFilesize
40KB
-
memory/2040-57-0x0000000007F80000-0x000000000801C000-memory.dmpFilesize
624KB
-
memory/2040-58-0x0000000000AB0000-0x0000000000AF0000-memory.dmpFilesize
256KB
-
memory/2040-54-0x00000000002B0000-0x0000000000392000-memory.dmpFilesize
904KB
-
memory/2040-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB