Analysis

  • max time kernel
    91s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 12:06

General

  • Target

    PAYMENT INSTRUCTIONS COPY.exe

  • Size

    374KB

  • MD5

    d6d939bd2a1263100823ea0374986d5b

  • SHA1

    47ac7811435eae2d9640befee318520c9df3f3bb

  • SHA256

    9398978502aef97b52b10321c7a0d177a4f16d1dc260ad29e8d7cd099b2c8dcb

  • SHA512

    710ca536a6cb94a2086129d79123a25c077a4be9ea89fac6da2e3ea942fd1a2aa4b0931df894da4b64b6129922fedc8bf832fea7b097d6f25a9119cc8a312bbd

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.pcandles.sa
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    almadi@123

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload 1 IoCs
  • Drops startup file 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PAYMENT INSTRUCTIONS COPY.exe
    "C:\Users\Admin\AppData\Local\Temp\PAYMENT INSTRUCTIONS COPY.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1188
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:2108
      • C:\Windows\SysWOW64\netsh.exe
        "netsh" wlan show profile
        3⤵
          PID:116

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Credential Access

    Credentials in Files

    3
    T1081

    Collection

    Data from Local System

    3
    T1005

    Email Collection

    1
    T1114

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/116-138-0x0000000000000000-mapping.dmp
    • memory/1188-130-0x00000000006B0000-0x0000000000714000-memory.dmp
      Filesize

      400KB

    • memory/1188-131-0x0000000001070000-0x000000000111B000-memory.dmp
      Filesize

      684KB

    • memory/2108-132-0x0000000000000000-mapping.dmp
    • memory/2108-133-0x0000000000400000-0x0000000000452000-memory.dmp
      Filesize

      328KB

    • memory/2108-134-0x0000000005A60000-0x0000000006004000-memory.dmp
      Filesize

      5.6MB

    • memory/2108-135-0x0000000005270000-0x0000000005302000-memory.dmp
      Filesize

      584KB

    • memory/2108-136-0x00000000054B0000-0x000000000554C000-memory.dmp
      Filesize

      624KB

    • memory/2108-137-0x00000000059C0000-0x0000000005A26000-memory.dmp
      Filesize

      408KB

    • memory/2108-139-0x0000000006610000-0x0000000006660000-memory.dmp
      Filesize

      320KB

    • memory/2108-140-0x00000000067C0000-0x00000000067CA000-memory.dmp
      Filesize

      40KB