Overview

overview

10

Static

static

9

SSCN_12462020pdf.exe

windows7_x64

10

SSCN_12462020pdf.exe

windows10-2004_x64

10
General
Target

SSCN_12462020pdf.exe

Filesize

444KB

Completed

21-05-2022 19:00

Task

behavioral1

Score
10/10
MD5

33d17dffd1221cd066f45811323b44b1

SHA1

4412bb573391d3466ba49d0d0451d0bb73b245c8

SHA256

ba2937327a241e543cddc12d8c1648db557d5408cc4fe8d06a5261d2d96896ca

SHA256

b7f6c51325171a8d3d6b89c07ebf6715f74ba4fa19bd62f781719c540494a18c0c659301957b34c6bce4ea5f7cf837fe6f299d7a56d8f97e2cc54bd62b3ae8dd

Malware Config

Extracted

Family

agenttesla
Credentials

Protocol: smtp

Host: secure231.servconfig.com

Port: 587

Username: info@eltaef.com

Password: eltaefSH6548883
Signatures 14

Filter: none

Collection
Credential Access
Discovery
Persistence
  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    Tags

  • AgentTesla Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1252-61-0x0000000000400000-0x0000000000452000-memory.dmpfamily_agenttesla
    behavioral1/memory/1252-63-0x0000000000400000-0x0000000000452000-memory.dmpfamily_agenttesla
    behavioral1/memory/1252-62-0x0000000000400000-0x0000000000452000-memory.dmpfamily_agenttesla
    behavioral1/memory/1252-64-0x000000000044CB2E-mapping.dmpfamily_agenttesla
    behavioral1/memory/1252-66-0x0000000000400000-0x0000000000452000-memory.dmpfamily_agenttesla
    behavioral1/memory/1252-68-0x0000000000400000-0x0000000000452000-memory.dmpfamily_agenttesla
  • Reads data files stored by FTP clients

    Description

    Tries to access configuration files associated with programs like FileZilla.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Reads user/profile data of local email clients

    Description

    Email clients store some user data on disk where infostealers will often target it.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Accesses Microsoft Outlook profiles
    SSCN_12462020pdf.exe

    Tags

    TTPs

    Email Collection

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676SSCN_12462020pdf.exe
    Key opened\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676SSCN_12462020pdf.exe
    Key opened\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676SSCN_12462020pdf.exe
  • Suspicious use of SetThreadContext
    SSCN_12462020pdf.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 948 set thread context of 1252948SSCN_12462020pdf.exeSSCN_12462020pdf.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    Tags

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    2004schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    SSCN_12462020pdf.exeSSCN_12462020pdf.exe

    Reported IOCs

    pidprocess
    948SSCN_12462020pdf.exe
    948SSCN_12462020pdf.exe
    948SSCN_12462020pdf.exe
    948SSCN_12462020pdf.exe
    948SSCN_12462020pdf.exe
    1252SSCN_12462020pdf.exe
    1252SSCN_12462020pdf.exe
  • Suspicious use of AdjustPrivilegeToken
    SSCN_12462020pdf.exeSSCN_12462020pdf.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege948SSCN_12462020pdf.exe
    Token: SeDebugPrivilege1252SSCN_12462020pdf.exe
  • Suspicious use of WriteProcessMemory
    SSCN_12462020pdf.exeSSCN_12462020pdf.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 948 wrote to memory of 2004948SSCN_12462020pdf.exeschtasks.exe
    PID 948 wrote to memory of 2004948SSCN_12462020pdf.exeschtasks.exe
    PID 948 wrote to memory of 2004948SSCN_12462020pdf.exeschtasks.exe
    PID 948 wrote to memory of 2004948SSCN_12462020pdf.exeschtasks.exe
    PID 948 wrote to memory of 1112948SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 948 wrote to memory of 1112948SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 948 wrote to memory of 1112948SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 948 wrote to memory of 1112948SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 948 wrote to memory of 1244948SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 948 wrote to memory of 1244948SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 948 wrote to memory of 1244948SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 948 wrote to memory of 1244948SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 948 wrote to memory of 1252948SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 948 wrote to memory of 1252948SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 948 wrote to memory of 1252948SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 948 wrote to memory of 1252948SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 948 wrote to memory of 1252948SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 948 wrote to memory of 1252948SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 948 wrote to memory of 1252948SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 948 wrote to memory of 1252948SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 948 wrote to memory of 1252948SSCN_12462020pdf.exeSSCN_12462020pdf.exe
    PID 1252 wrote to memory of 8401252SSCN_12462020pdf.exenetsh.exe
    PID 1252 wrote to memory of 8401252SSCN_12462020pdf.exenetsh.exe
    PID 1252 wrote to memory of 8401252SSCN_12462020pdf.exenetsh.exe
    PID 1252 wrote to memory of 8401252SSCN_12462020pdf.exenetsh.exe
  • outlook_office_path
    SSCN_12462020pdf.exe

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676SSCN_12462020pdf.exe
  • outlook_win_path
    SSCN_12462020pdf.exe

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676SSCN_12462020pdf.exe
Processes 6
  • C:\Users\Admin\AppData\Local\Temp\SSCN_12462020pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\SSCN_12462020pdf.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:948
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XkNVCBG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDB8.tmp"
      Creates scheduled task(s)
      PID:2004
    • C:\Users\Admin\AppData\Local\Temp\SSCN_12462020pdf.exe
      "{path}"
      PID:1112
    • C:\Users\Admin\AppData\Local\Temp\SSCN_12462020pdf.exe
      "{path}"
      PID:1244
    • C:\Users\Admin\AppData\Local\Temp\SSCN_12462020pdf.exe
      "{path}"
      Accesses Microsoft Outlook profiles
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      outlook_office_path
      outlook_win_path
      PID:1252
      • C:\Windows\SysWOW64\netsh.exe
        "netsh" wlan show profile
        PID:840
Network
MITRE ATT&CK Matrix
Collection
Command and Control
    Credential Access
    Defense Evasion
      Discovery
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                Privilege Escalation
                  Replay Monitor
                  00:00 00:00
                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\tmpDB8.tmp

                    MD5

                    860add37e21ae9ad8c82247c6e65bef1

                    SHA1

                    ebf05faed730fa6b86be356f3c2b47615ed75173

                    SHA256

                    9e2bd6d74bab3d16381586923f18d1d46f317f35f131559a696f6f8925f5ef85

                    SHA512

                    f7564718e791559eb3b4539f8000076839c911e73991fcbed8c2f0ded404f56ebb3ba6267e1d4dfba2c8a79e732919c931728d588dc6f11d2c03c61727dc2d5a

                    Download Submit

                  • memory/840-71-0x0000000000000000-mapping.dmp

                    Download

                  • memory/948-55-0x0000000074970000-0x0000000074F1B000-memory.dmp

                    Download

                  • memory/948-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

                    Download

                  • memory/1252-58-0x0000000000400000-0x0000000000452000-memory.dmp

                    Download

                  • memory/1252-59-0x0000000000400000-0x0000000000452000-memory.dmp

                    Download

                  • memory/1252-61-0x0000000000400000-0x0000000000452000-memory.dmp

                    Download

                  • memory/1252-63-0x0000000000400000-0x0000000000452000-memory.dmp

                    Download

                  • memory/1252-62-0x0000000000400000-0x0000000000452000-memory.dmp

                    Download

                  • memory/1252-64-0x000000000044CB2E-mapping.dmp

                    Download

                  • memory/1252-66-0x0000000000400000-0x0000000000452000-memory.dmp

                    Download

                  • memory/1252-68-0x0000000000400000-0x0000000000452000-memory.dmp

                    Download

                  • memory/1252-70-0x0000000074970000-0x0000000074F1B000-memory.dmp

                    Download

                  • memory/2004-56-0x0000000000000000-mapping.dmp

                    Download