Analysis
-
max time kernel
150s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 11:05
Static task
static1
Behavioral task
behavioral1
Sample
PO20201.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO20201.exe
Resource
win10v2004-20220414-en
General
-
Target
PO20201.exe
-
Size
1.6MB
-
MD5
144ef7cef25ba3310000ddb81ec5192c
-
SHA1
b1ab1c5509afb2fda7cf8de4df971ec24ae48e49
-
SHA256
ef198e1bc193d5b0e033b27059f10e3ae7a5b696f2157bda94d765cc353d6952
-
SHA512
343cbb325758832b4f7a683fe28aad451f790c450e1ec49e57ca3c71c57ae15b825b878ca2db923070fc8cfe7c97b8104da80eda2e5bcc732a83bd934f1d11fa
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.durainteriordesign.com - Port:
587 - Username:
[email protected] - Password:
successman12
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1588-59-0x0000000000080000-0x00000000000D2000-memory.dmp family_agenttesla behavioral1/memory/1588-64-0x00000000000CCF1E-mapping.dmp family_agenttesla behavioral1/memory/1588-65-0x0000000000080000-0x00000000000D2000-memory.dmp family_agenttesla behavioral1/memory/1588-66-0x0000000000080000-0x00000000000D2000-memory.dmp family_agenttesla -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
MSBuild.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts MSBuild.exe -
Drops startup file 1 IoCs
Processes:
PO20201.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ssh-keygen.url PO20201.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO20201.exedescription pid process target process PID 1868 set thread context of 1588 1868 PO20201.exe MSBuild.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
MSBuild.exePO20201.exepid process 1588 MSBuild.exe 1588 MSBuild.exe 1868 PO20201.exe 1868 PO20201.exe 1868 PO20201.exe 1868 PO20201.exe 1868 PO20201.exe 1868 PO20201.exe 1868 PO20201.exe 1868 PO20201.exe 1868 PO20201.exe 1868 PO20201.exe 1868 PO20201.exe 1868 PO20201.exe 1868 PO20201.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 1588 MSBuild.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
PO20201.exepid process 1868 PO20201.exe 1868 PO20201.exe 1868 PO20201.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
PO20201.exepid process 1868 PO20201.exe 1868 PO20201.exe 1868 PO20201.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
PO20201.exeMSBuild.exedescription pid process target process PID 1868 wrote to memory of 1588 1868 PO20201.exe MSBuild.exe PID 1868 wrote to memory of 1588 1868 PO20201.exe MSBuild.exe PID 1868 wrote to memory of 1588 1868 PO20201.exe MSBuild.exe PID 1868 wrote to memory of 1588 1868 PO20201.exe MSBuild.exe PID 1868 wrote to memory of 1588 1868 PO20201.exe MSBuild.exe PID 1868 wrote to memory of 1588 1868 PO20201.exe MSBuild.exe PID 1588 wrote to memory of 1608 1588 MSBuild.exe REG.exe PID 1588 wrote to memory of 1608 1588 MSBuild.exe REG.exe PID 1588 wrote to memory of 1608 1588 MSBuild.exe REG.exe PID 1588 wrote to memory of 1608 1588 MSBuild.exe REG.exe PID 1588 wrote to memory of 1748 1588 MSBuild.exe netsh.exe PID 1588 wrote to memory of 1748 1588 MSBuild.exe netsh.exe PID 1588 wrote to memory of 1748 1588 MSBuild.exe netsh.exe PID 1588 wrote to memory of 1748 1588 MSBuild.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO20201.exe"C:\Users\Admin\AppData\Local\Temp\PO20201.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1588-57-0x0000000000080000-0x00000000000D2000-memory.dmpFilesize
328KB
-
memory/1588-59-0x0000000000080000-0x00000000000D2000-memory.dmpFilesize
328KB
-
memory/1588-64-0x00000000000CCF1E-mapping.dmp
-
memory/1588-65-0x0000000000080000-0x00000000000D2000-memory.dmpFilesize
328KB
-
memory/1588-66-0x0000000000080000-0x00000000000D2000-memory.dmpFilesize
328KB
-
memory/1608-68-0x0000000000000000-mapping.dmp
-
memory/1748-69-0x0000000000000000-mapping.dmp
-
memory/1868-54-0x00000000759E1000-0x00000000759E3000-memory.dmpFilesize
8KB
-
memory/1868-55-0x0000000001050000-0x00000000010E8000-memory.dmpFilesize
608KB
-
memory/1868-56-0x0000000003C00000-0x0000000003C98000-memory.dmpFilesize
608KB