Analysis
-
max time kernel
164s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:42
Static task
static1
Behavioral task
behavioral1
Sample
6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exe
Resource
win10v2004-20220414-en
General
-
Target
6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exe
-
Size
768KB
-
MD5
22dbfe74635797260671cd5dbbf0a3bc
-
SHA1
8cbdde1a2319ee60c9f6a9e05d2879362ab44668
-
SHA256
6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91
-
SHA512
713fa04c7dbf9612bf69336d0cc3b56f433db712a516a6496160706135fad58e8a31cb2a54e893ecebb49b34bf7466b330d44f1e9446fde0af9cda3f118eb88e
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1960-71-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1960-72-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1960-73-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1960-74-0x00000000004468DE-mapping.dmp family_agenttesla behavioral1/memory/1960-77-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1960-79-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Executes dropped EXE 2 IoCs
Processes:
system32.exeInstallUtil.exepid process 1984 system32.exe 1960 InstallUtil.exe -
Loads dropped DLL 2 IoCs
Processes:
6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exesystem32.exepid process 1760 6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exe 1984 system32.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\system32 = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\system32.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
system32.exedescription pid process target process PID 1984 set thread context of 1960 1984 system32.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exesystem32.exeInstallUtil.exepid process 1760 6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exe 1760 6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exe 1984 system32.exe 1984 system32.exe 1984 system32.exe 1960 InstallUtil.exe 1960 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exesystem32.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1760 6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exe Token: SeDebugPrivilege 1984 system32.exe Token: SeDebugPrivilege 1960 InstallUtil.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.execmd.exesystem32.exedescription pid process target process PID 1760 wrote to memory of 1248 1760 6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exe cmd.exe PID 1760 wrote to memory of 1248 1760 6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exe cmd.exe PID 1760 wrote to memory of 1248 1760 6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exe cmd.exe PID 1760 wrote to memory of 1248 1760 6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exe cmd.exe PID 1248 wrote to memory of 2036 1248 cmd.exe reg.exe PID 1248 wrote to memory of 2036 1248 cmd.exe reg.exe PID 1248 wrote to memory of 2036 1248 cmd.exe reg.exe PID 1248 wrote to memory of 2036 1248 cmd.exe reg.exe PID 1760 wrote to memory of 1984 1760 6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exe system32.exe PID 1760 wrote to memory of 1984 1760 6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exe system32.exe PID 1760 wrote to memory of 1984 1760 6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exe system32.exe PID 1760 wrote to memory of 1984 1760 6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exe system32.exe PID 1984 wrote to memory of 1960 1984 system32.exe InstallUtil.exe PID 1984 wrote to memory of 1960 1984 system32.exe InstallUtil.exe PID 1984 wrote to memory of 1960 1984 system32.exe InstallUtil.exe PID 1984 wrote to memory of 1960 1984 system32.exe InstallUtil.exe PID 1984 wrote to memory of 1960 1984 system32.exe InstallUtil.exe PID 1984 wrote to memory of 1960 1984 system32.exe InstallUtil.exe PID 1984 wrote to memory of 1960 1984 system32.exe InstallUtil.exe PID 1984 wrote to memory of 1960 1984 system32.exe InstallUtil.exe PID 1984 wrote to memory of 1960 1984 system32.exe InstallUtil.exe PID 1984 wrote to memory of 1960 1984 system32.exe InstallUtil.exe PID 1984 wrote to memory of 1960 1984 system32.exe InstallUtil.exe PID 1984 wrote to memory of 1960 1984 system32.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exe"C:\Users\Admin\AppData\Local\Temp\6a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v system32 /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\system32.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v system32 /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\system32.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\system32.exe"C:\Users\Admin\system32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\system32.exeFilesize
768KB
MD522dbfe74635797260671cd5dbbf0a3bc
SHA18cbdde1a2319ee60c9f6a9e05d2879362ab44668
SHA2566a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91
SHA512713fa04c7dbf9612bf69336d0cc3b56f433db712a516a6496160706135fad58e8a31cb2a54e893ecebb49b34bf7466b330d44f1e9446fde0af9cda3f118eb88e
-
C:\Users\Admin\system32.exeFilesize
768KB
MD522dbfe74635797260671cd5dbbf0a3bc
SHA18cbdde1a2319ee60c9f6a9e05d2879362ab44668
SHA2566a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91
SHA512713fa04c7dbf9612bf69336d0cc3b56f433db712a516a6496160706135fad58e8a31cb2a54e893ecebb49b34bf7466b330d44f1e9446fde0af9cda3f118eb88e
-
\Users\Admin\AppData\Local\Temp\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
\Users\Admin\system32.exeFilesize
768KB
MD522dbfe74635797260671cd5dbbf0a3bc
SHA18cbdde1a2319ee60c9f6a9e05d2879362ab44668
SHA2566a83f449fc1dd1f88e89ba47a29c8e3a12b04145ae4377cddc5ca5a93ead0c91
SHA512713fa04c7dbf9612bf69336d0cc3b56f433db712a516a6496160706135fad58e8a31cb2a54e893ecebb49b34bf7466b330d44f1e9446fde0af9cda3f118eb88e
-
memory/1248-57-0x0000000000000000-mapping.dmp
-
memory/1760-55-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1760-56-0x0000000075361000-0x0000000075363000-memory.dmpFilesize
8KB
-
memory/1760-54-0x0000000000930000-0x00000000009F6000-memory.dmpFilesize
792KB
-
memory/1960-71-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1960-68-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1960-69-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1960-72-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1960-73-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1960-74-0x00000000004468DE-mapping.dmp
-
memory/1960-77-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1960-79-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1984-65-0x0000000000580000-0x000000000058A000-memory.dmpFilesize
40KB
-
memory/1984-63-0x0000000001180000-0x0000000001246000-memory.dmpFilesize
792KB
-
memory/1984-60-0x0000000000000000-mapping.dmp
-
memory/2036-58-0x0000000000000000-mapping.dmp