Analysis
-
max time kernel
201s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 21:27
General
-
Target
BL_Shipping Document PDF.exe
-
Size
439KB
-
MD5
3f16dc55906e2ec3b441e51dcb65f573
-
SHA1
549f8e950444c2ee0999af67fd69421346806a78
-
SHA256
6a319e1263ff7737b5d370e6d0c6202ecc7fddfb5cdec927514b8b7586ab0c3f
-
SHA512
43bc2b4332cc0047e37f3986edd70d409aeed3a62413b24723eda28dd374eca81177b7bff228a94e98dca9261999ee403c1e13fd54e9aae525a7e8d272f6684b
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.mosaiclayouts.com - Port:
587 - Username:
sales@mosaiclayouts.com - Password:
UY$W4+]^+9;)7CF5
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
-
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BL_Shipping Document PDF.exe"C:\Users\Admin\AppData\Local\Temp\BL_Shipping Document PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\raEXEmWYJZfP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF806.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\BL_Shipping Document PDF.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF806.tmpFilesize
1KB
MD575acc3a01b81795389b874efa5218692
SHA1383374a754824ac45fcc91e3b75c2f7ac0a94684
SHA256f7769c292f27f1931cf21bc265672a04a7fd53fc292b2b5bee4cdd8eaf740548
SHA512a4333a785dd70d4f448c66f6befb2a0aa9e82a06178d1e3a7c6658fe12658692a529d31c2aad8de39a8cec0f0f9b8dd5f65820f0d9728fc9125d10a6f28a58b3
-
memory/1368-64-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1368-60-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1368-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1368-63-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1368-65-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1368-66-0x000000000044797E-mapping.dmp
-
memory/1368-68-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1368-70-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1692-58-0x0000000000000000-mapping.dmp
-
memory/1988-56-0x0000000000320000-0x0000000000330000-memory.dmpFilesize
64KB
-
memory/1988-57-0x0000000000700000-0x0000000000754000-memory.dmpFilesize
336KB
-
memory/1988-55-0x00000000754A1000-0x00000000754A3000-memory.dmpFilesize
8KB
-
memory/1988-54-0x0000000001230000-0x00000000012A4000-memory.dmpFilesize
464KB