General

  • Target

    document000000.exe

  • Size

    425KB

  • Sample

    220522-f2qn8sffe5

  • MD5

    4ce67ec4bfaff0ec070a5cb7cfb6ae7b

  • SHA1

    ff8a7f2e327ab3bc333bb2388e1ce6b1cf10dbe2

  • SHA256

    939c113bbadc98a7eac2f513b5815005abf579d53aa584b0869df8b5d863df59

  • SHA512

    1a2a065b8160f1912b32ce826b72fc1362bb3f84d2a43fef2618f954396aa8dd5e14f5f62eca3597e46be1faacaaeaa56748345ef8f9db547d175e743140440b

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.nysainternational.in
  • Port:
    587
  • Username:
    info@nysainternational.in
  • Password:
    Bewaqoof123@

Targets

    • Target

      document000000.exe

    • Size

      425KB

    • MD5

      4ce67ec4bfaff0ec070a5cb7cfb6ae7b

    • SHA1

      ff8a7f2e327ab3bc333bb2388e1ce6b1cf10dbe2

    • SHA256

      939c113bbadc98a7eac2f513b5815005abf579d53aa584b0869df8b5d863df59

    • SHA512

      1a2a065b8160f1912b32ce826b72fc1362bb3f84d2a43fef2618f954396aa8dd5e14f5f62eca3597e46be1faacaaeaa56748345ef8f9db547d175e743140440b

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Tasks