Analysis
-
max time kernel
123s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:03
Static task
static1
Behavioral task
behavioral1
Sample
PORPOP.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PORPOP.exe
Resource
win10v2004-20220414-en
General
-
Target
PORPOP.exe
-
Size
516KB
-
MD5
e4f5fa9448aa0d4bab63566ae4162e56
-
SHA1
d665acebc8692d7e98fe7cb1ef56202e885156fd
-
SHA256
6d74007e7ac24c71ab27dd72dcbf6cc0a7caf046ca1f55eeeacf1e17f73b9d99
-
SHA512
22393ee278ebd8fde36affbab92194bc9e8be5d1b8d2752830af2a809ab9084208e67ea5e414d51be27d580e1b1affd969224e8a394709029c052e3fd84ed541
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.israelagroconsultant.com - Port:
587 - Username:
[email protected] - Password:
israelagro@123
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1072-61-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1072-62-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1072-63-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1072-64-0x000000000044C75E-mapping.dmp family_agenttesla behavioral1/memory/1072-66-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1072-68-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla -
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral1/memory/560-57-0x0000000004FC0000-0x0000000005018000-memory.dmp rezer0 -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PORPOP.exedescription pid process target process PID 560 set thread context of 1072 560 PORPOP.exe RegSvcs.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
PORPOP.exeRegSvcs.exepid process 560 PORPOP.exe 1072 RegSvcs.exe 1072 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PORPOP.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 560 PORPOP.exe Token: SeDebugPrivilege 1072 RegSvcs.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
PORPOP.exeRegSvcs.exedescription pid process target process PID 560 wrote to memory of 936 560 PORPOP.exe RegSvcs.exe PID 560 wrote to memory of 936 560 PORPOP.exe RegSvcs.exe PID 560 wrote to memory of 936 560 PORPOP.exe RegSvcs.exe PID 560 wrote to memory of 936 560 PORPOP.exe RegSvcs.exe PID 560 wrote to memory of 936 560 PORPOP.exe RegSvcs.exe PID 560 wrote to memory of 936 560 PORPOP.exe RegSvcs.exe PID 560 wrote to memory of 936 560 PORPOP.exe RegSvcs.exe PID 560 wrote to memory of 1072 560 PORPOP.exe RegSvcs.exe PID 560 wrote to memory of 1072 560 PORPOP.exe RegSvcs.exe PID 560 wrote to memory of 1072 560 PORPOP.exe RegSvcs.exe PID 560 wrote to memory of 1072 560 PORPOP.exe RegSvcs.exe PID 560 wrote to memory of 1072 560 PORPOP.exe RegSvcs.exe PID 560 wrote to memory of 1072 560 PORPOP.exe RegSvcs.exe PID 560 wrote to memory of 1072 560 PORPOP.exe RegSvcs.exe PID 560 wrote to memory of 1072 560 PORPOP.exe RegSvcs.exe PID 560 wrote to memory of 1072 560 PORPOP.exe RegSvcs.exe PID 560 wrote to memory of 1072 560 PORPOP.exe RegSvcs.exe PID 560 wrote to memory of 1072 560 PORPOP.exe RegSvcs.exe PID 560 wrote to memory of 1072 560 PORPOP.exe RegSvcs.exe PID 1072 wrote to memory of 316 1072 RegSvcs.exe REG.exe PID 1072 wrote to memory of 316 1072 RegSvcs.exe REG.exe PID 1072 wrote to memory of 316 1072 RegSvcs.exe REG.exe PID 1072 wrote to memory of 316 1072 RegSvcs.exe REG.exe PID 1072 wrote to memory of 1472 1072 RegSvcs.exe netsh.exe PID 1072 wrote to memory of 1472 1072 RegSvcs.exe netsh.exe PID 1072 wrote to memory of 1472 1072 RegSvcs.exe netsh.exe PID 1072 wrote to memory of 1472 1072 RegSvcs.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PORPOP.exe"C:\Users\Admin\AppData\Local\Temp\PORPOP.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵PID:936
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1072 -
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
PID:316 -
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵PID:1472
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-70-0x0000000000000000-mapping.dmp
-
memory/560-54-0x00000000010A0000-0x0000000001128000-memory.dmpFilesize
544KB
-
memory/560-55-0x0000000075701000-0x0000000075703000-memory.dmpFilesize
8KB
-
memory/560-56-0x0000000000580000-0x0000000000590000-memory.dmpFilesize
64KB
-
memory/560-57-0x0000000004FC0000-0x0000000005018000-memory.dmpFilesize
352KB
-
memory/1072-61-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1072-59-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1072-62-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1072-63-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1072-64-0x000000000044C75E-mapping.dmp
-
memory/1072-66-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1072-68-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1072-58-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1472-71-0x0000000000000000-mapping.dmp