Analysis

  • max time kernel
    120s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 12:03

General

  • Target

    3582133.exe

  • Size

    460KB

  • MD5

    814d60b47619ff47a081818e6d2fdb02

  • SHA1

    3356b6d7a362db8c0aa04afe798870aa6f9ae966

  • SHA256

    e4392c3867a7b38a96f352f3249358e0144717bde4adf6473e5f994904a98bb3

  • SHA512

    edabbcc51509ec59a908616d7d3b43f8e56f99a026e218b8fd6980de382618c83cd890a983a7774517d1853c356f8f6df19173976740a4f774bb0976c9bf43fa

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.israelagroconsultant.com
  • Port:
    587
  • Username:
    info@israelagroconsultant.com
  • Password:
    israelagro@123

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • CoreEntity .NET Packer 1 IoCs

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

  • AgentTesla Payload 6 IoCs
  • ReZer0 packer 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

  • Disables Task Manager via registry modification
  • Drops file in Drivers directory 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3582133.exe
    "C:\Users\Admin\AppData\Local\Temp\3582133.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "{path}"
      2⤵
        PID:936
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "{path}"
        2⤵
          PID:1468
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "{path}"
          2⤵
            PID:608
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "{path}"
            2⤵
            • Drops file in Drivers directory
            • Accesses Microsoft Outlook profiles
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • outlook_office_path
            • outlook_win_path
            PID:1392
            • C:\Windows\SysWOW64\REG.exe
              REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
              3⤵
              • Modifies registry key
              PID:1004
            • C:\Windows\SysWOW64\netsh.exe
              "netsh" wlan show profile
              3⤵
                PID:572

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Defense Evasion

          Modify Registry

          1
          T1112

          Collection

          Email Collection

          1
          T1114

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/572-71-0x0000000000000000-mapping.dmp
          • memory/1004-70-0x0000000000000000-mapping.dmp
          • memory/1392-64-0x000000000044C75E-mapping.dmp
          • memory/1392-58-0x0000000000400000-0x0000000000452000-memory.dmp
            Filesize

            328KB

          • memory/1392-59-0x0000000000400000-0x0000000000452000-memory.dmp
            Filesize

            328KB

          • memory/1392-61-0x0000000000400000-0x0000000000452000-memory.dmp
            Filesize

            328KB

          • memory/1392-62-0x0000000000400000-0x0000000000452000-memory.dmp
            Filesize

            328KB

          • memory/1392-63-0x0000000000400000-0x0000000000452000-memory.dmp
            Filesize

            328KB

          • memory/1392-68-0x0000000000400000-0x0000000000452000-memory.dmp
            Filesize

            328KB

          • memory/1392-66-0x0000000000400000-0x0000000000452000-memory.dmp
            Filesize

            328KB

          • memory/1832-57-0x00000000005E0000-0x0000000000638000-memory.dmp
            Filesize

            352KB

          • memory/1832-54-0x0000000000F80000-0x0000000000FFA000-memory.dmp
            Filesize

            488KB

          • memory/1832-56-0x0000000000290000-0x0000000000298000-memory.dmp
            Filesize

            32KB

          • memory/1832-55-0x0000000076191000-0x0000000076193000-memory.dmp
            Filesize

            8KB