Analysis

  • max time kernel
    146s
  • max time network
    186s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 12:03

General

  • Target

    3582133.exe

  • Size

    460KB

  • MD5

    814d60b47619ff47a081818e6d2fdb02

  • SHA1

    3356b6d7a362db8c0aa04afe798870aa6f9ae966

  • SHA256

    e4392c3867a7b38a96f352f3249358e0144717bde4adf6473e5f994904a98bb3

  • SHA512

    edabbcc51509ec59a908616d7d3b43f8e56f99a026e218b8fd6980de382618c83cd890a983a7774517d1853c356f8f6df19173976740a4f774bb0976c9bf43fa

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.israelagroconsultant.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    israelagro@123

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload 1 IoCs
  • Disables Task Manager via registry modification
  • Drops file in Drivers directory 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3582133.exe
    "C:\Users\Admin\AppData\Local\Temp\3582133.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4092
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "{path}"
      2⤵
      • Drops file in Drivers directory
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:2880
      • C:\Windows\SysWOW64\REG.exe
        REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        3⤵
        • Modifies registry key
        PID:4980
      • C:\Windows\SysWOW64\netsh.exe
        "netsh" wlan show profile
        3⤵
          PID:4548
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 1592
          3⤵
          • Program crash
          PID:1796
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2880 -ip 2880
      1⤵
        PID:3924

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Defense Evasion

      Modify Registry

      1
      T1112

      Collection

      Email Collection

      1
      T1114

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2880-135-0x0000000000000000-mapping.dmp
      • memory/2880-136-0x0000000000400000-0x0000000000452000-memory.dmp
        Filesize

        328KB

      • memory/2880-137-0x0000000005D70000-0x0000000005DD6000-memory.dmp
        Filesize

        408KB

      • memory/2880-140-0x0000000001590000-0x00000000015E0000-memory.dmp
        Filesize

        320KB

      • memory/4092-130-0x00000000009E0000-0x0000000000A5A000-memory.dmp
        Filesize

        488KB

      • memory/4092-131-0x0000000005AD0000-0x0000000006074000-memory.dmp
        Filesize

        5.6MB

      • memory/4092-132-0x00000000053F0000-0x0000000005482000-memory.dmp
        Filesize

        584KB

      • memory/4092-133-0x00000000054A0000-0x00000000054AA000-memory.dmp
        Filesize

        40KB

      • memory/4092-134-0x0000000006180000-0x000000000621C000-memory.dmp
        Filesize

        624KB

      • memory/4548-139-0x0000000000000000-mapping.dmp
      • memory/4980-138-0x0000000000000000-mapping.dmp