Analysis

  • max time kernel
    103s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 14:06

General

  • Target

    tmp.exe

  • Size

    680KB

  • MD5

    d29958ffc3ebde050e992fe24b7d735a

  • SHA1

    a2d56009c08f6f44ebcb42a1594a6a20530a6c6f

  • SHA256

    75f2ff197bf14319cfa73c515597453f6a50d56ce2fe39c384f445b3431a9960

  • SHA512

    ad845dcec8ed0c1fe4499e553fa1c0c632d9f2e5b909e32356514ec165113e0676784a106826fb6d73da8c1ee7810aa860fe1bb295046cce7895532af4050a62

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5368056296:AAHgHHTnRAZx9eL5AZ1arY8hwWaEJUMdR18/sendDocument

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1092
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:3696

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tmp.exe.log
    Filesize

    1KB

    MD5

    8323fae9fbc8238dfd3efdc87ac3534c

    SHA1

    d88623828a38d6b528963a32902c9f336a08942e

    SHA256

    1ccd81d339d51696fa8569e0ea179873452e8aa087b14a397538cda74996fe00

    SHA512

    9a50d78360761b85c2b49fd2959744c004a74600ffef5756391fec0f02c8aafc6061a028518808693297f03e9fc65067e3d4b29d876ed70eb8e2ad9094d246c3

  • memory/1092-130-0x0000000000120000-0x00000000001CA000-memory.dmp
    Filesize

    680KB

  • memory/1092-131-0x0000000005180000-0x0000000005724000-memory.dmp
    Filesize

    5.6MB

  • memory/1092-132-0x0000000004BD0000-0x0000000004C62000-memory.dmp
    Filesize

    584KB

  • memory/1092-133-0x0000000004B60000-0x0000000004B6A000-memory.dmp
    Filesize

    40KB

  • memory/1092-134-0x0000000004F10000-0x0000000004FAC000-memory.dmp
    Filesize

    624KB

  • memory/1092-135-0x0000000007680000-0x00000000076E6000-memory.dmp
    Filesize

    408KB

  • memory/3696-136-0x0000000000000000-mapping.dmp
  • memory/3696-137-0x0000000000400000-0x000000000043A000-memory.dmp
    Filesize

    232KB

  • memory/3696-139-0x0000000006260000-0x00000000062B0000-memory.dmp
    Filesize

    320KB