Analysis
-
max time kernel
123s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 10:36
Static task
static1
Behavioral task
behavioral1
Sample
00-197-SA CONTROL-M5125.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
00-197-SA CONTROL-M5125.exe
Resource
win10v2004-20220414-en
General
-
Target
00-197-SA CONTROL-M5125.exe
-
Size
1.7MB
-
MD5
9f087d8b30fd9b2d64382722131337b8
-
SHA1
1db83cf40ce6b0be89672842cbeb7c9c501877d8
-
SHA256
b11297ccdc36a277df52b8952f8e880103bbce07e79a5bb402fc70738dc45b01
-
SHA512
03eba2aa6926168cdbfe7a0d75bdad69017843bd5b29b5591ebbe027fd783bc74de78b1ad527d44066a51b9eba2c11350179e95e0474c95d1e237f2fc79d971c
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pptoursperu.com - Port:
587 - Username:
[email protected] - Password:
mailppt2019-
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1720-59-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla behavioral1/memory/1720-64-0x000000000044ABAE-mapping.dmp family_agenttesla behavioral1/memory/1720-65-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla behavioral1/memory/1720-66-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
MSBuild.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts MSBuild.exe -
Drops startup file 1 IoCs
Processes:
00-197-SA CONTROL-M5125.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CloudStorageWizard.url 00-197-SA CONTROL-M5125.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
00-197-SA CONTROL-M5125.exedescription pid process target process PID 2024 set thread context of 1720 2024 00-197-SA CONTROL-M5125.exe MSBuild.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
MSBuild.exepid process 1720 MSBuild.exe 1720 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 1720 MSBuild.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
00-197-SA CONTROL-M5125.exepid process 2024 00-197-SA CONTROL-M5125.exe 2024 00-197-SA CONTROL-M5125.exe 2024 00-197-SA CONTROL-M5125.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
00-197-SA CONTROL-M5125.exepid process 2024 00-197-SA CONTROL-M5125.exe 2024 00-197-SA CONTROL-M5125.exe 2024 00-197-SA CONTROL-M5125.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
00-197-SA CONTROL-M5125.exeMSBuild.exedescription pid process target process PID 2024 wrote to memory of 1720 2024 00-197-SA CONTROL-M5125.exe MSBuild.exe PID 2024 wrote to memory of 1720 2024 00-197-SA CONTROL-M5125.exe MSBuild.exe PID 2024 wrote to memory of 1720 2024 00-197-SA CONTROL-M5125.exe MSBuild.exe PID 2024 wrote to memory of 1720 2024 00-197-SA CONTROL-M5125.exe MSBuild.exe PID 2024 wrote to memory of 1720 2024 00-197-SA CONTROL-M5125.exe MSBuild.exe PID 2024 wrote to memory of 1720 2024 00-197-SA CONTROL-M5125.exe MSBuild.exe PID 1720 wrote to memory of 1500 1720 MSBuild.exe REG.exe PID 1720 wrote to memory of 1500 1720 MSBuild.exe REG.exe PID 1720 wrote to memory of 1500 1720 MSBuild.exe REG.exe PID 1720 wrote to memory of 1500 1720 MSBuild.exe REG.exe PID 1720 wrote to memory of 964 1720 MSBuild.exe netsh.exe PID 1720 wrote to memory of 964 1720 MSBuild.exe netsh.exe PID 1720 wrote to memory of 964 1720 MSBuild.exe netsh.exe PID 1720 wrote to memory of 964 1720 MSBuild.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00-197-SA CONTROL-M5125.exe"C:\Users\Admin\AppData\Local\Temp\00-197-SA CONTROL-M5125.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1720 -
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
PID:1500 -
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵PID:964
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/964-69-0x0000000000000000-mapping.dmp
-
memory/1500-68-0x0000000000000000-mapping.dmp
-
memory/1720-57-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1720-59-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1720-64-0x000000000044ABAE-mapping.dmp
-
memory/1720-65-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1720-66-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2024-54-0x0000000075381000-0x0000000075383000-memory.dmpFilesize
8KB
-
memory/2024-55-0x0000000023970000-0x0000000023A03000-memory.dmpFilesize
588KB
-
memory/2024-56-0x0000000041310000-0x00000000413A3000-memory.dmpFilesize
588KB