Analysis

  • max time kernel
    178s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 12:43

General

  • Target

    Payment Invoice-.exe

  • Size

    417KB

  • MD5

    0657f318a479e4ef02b4eb081ae1f8a4

  • SHA1

    dbb0026898b304f2b90347e9240a9a39514a4936

  • SHA256

    be21fe83f9230cc17ae46dc93ef917972b39f41da97ee9dfcd75099fc1b2b65d

  • SHA512

    7fec8f109d68b7b3ad1f76b3aef53ff02b37258d028b0f4ecbb748821f9b128308fc6094cbb403e787bbc71219c4f03ce9d028bc6c793b362c3a2f42c2f59506

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.saamaygroup.com
  • Port:
    587
  • Username:
    ashimdutta@saamaygroup.com
  • Password:
    pawan100

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Payment Invoice-.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment Invoice-.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "{path}"
      2⤵
      • Drops file in Drivers directory
      • Accesses Microsoft Outlook profiles
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:4912
      • C:\Windows\SysWOW64\REG.exe
        REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f
        3⤵
        • Modifies registry key
        PID:2740

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Collection

Email Collection

1
T1114

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1192-130-0x0000000000140000-0x00000000001AE000-memory.dmp
    Filesize

    440KB

  • memory/1192-131-0x0000000005060000-0x0000000005604000-memory.dmp
    Filesize

    5.6MB

  • memory/1192-132-0x00000000049F0000-0x0000000004A82000-memory.dmp
    Filesize

    584KB

  • memory/1192-133-0x00000000058E0000-0x000000000597C000-memory.dmp
    Filesize

    624KB

  • memory/2740-138-0x0000000000000000-mapping.dmp
  • memory/4912-134-0x0000000000000000-mapping.dmp
  • memory/4912-135-0x0000000000400000-0x000000000044C000-memory.dmp
    Filesize

    304KB

  • memory/4912-136-0x0000000005E70000-0x0000000005ED6000-memory.dmp
    Filesize

    408KB

  • memory/4912-137-0x00000000062D0000-0x0000000006320000-memory.dmp
    Filesize

    320KB

  • memory/4912-139-0x0000000006320000-0x000000000632A000-memory.dmp
    Filesize

    40KB