Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
27-06-2022 15:11
Static task
static1
Behavioral task
behavioral1
Sample
SbPbhXXaAe_ori40teleevery.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SbPbhXXaAe_ori40teleevery.js
Resource
win10v2004-20220414-en
General
-
Target
SbPbhXXaAe_ori40teleevery.js
-
Size
386KB
-
MD5
917298a0ef1125c31dfc7762135d9978
-
SHA1
b6902cd75e83cae4ff2a3ce12f0314d364d5f481
-
SHA256
173bf8f0a06a99b6ff4fd216a0be00b834aa4337828b91124da5d533e674fccf
-
SHA512
b1ad86cd50f605ecd3bd7e9d99835dd97f64f16efa97b416e08c1c61d311874807951b7e8a887d76a1de197643a68b863fab5644010756abf384941786d3b9e1
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5171883538:AAEyFWuNh68SJNNpkDCQbviRgrklZA3K4Qs/sendDocument
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request 16 IoCs
Processes:
wscript.exeflow pid process 4 2004 wscript.exe 7 2004 wscript.exe 8 2004 wscript.exe 10 2004 wscript.exe 12 2004 wscript.exe 13 2004 wscript.exe 15 2004 wscript.exe 16 2004 wscript.exe 17 2004 wscript.exe 19 2004 wscript.exe 20 2004 wscript.exe 21 2004 wscript.exe 23 2004 wscript.exe 24 2004 wscript.exe 25 2004 wscript.exe 27 2004 wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
ori40teleevery.exepid process 2036 ori40teleevery.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\siiOXfeLhL.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\siiOXfeLhL.js wscript.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
ori40teleevery.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ori40teleevery.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ori40teleevery.exe Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ori40teleevery.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\siiOXfeLhL.js\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ori40teleevery.exepid process 2036 ori40teleevery.exe 2036 ori40teleevery.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ori40teleevery.exedescription pid process Token: SeDebugPrivilege 2036 ori40teleevery.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ori40teleevery.exepid process 2036 ori40teleevery.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
wscript.exedescription pid process target process PID 868 wrote to memory of 2004 868 wscript.exe wscript.exe PID 868 wrote to memory of 2004 868 wscript.exe wscript.exe PID 868 wrote to memory of 2004 868 wscript.exe wscript.exe PID 868 wrote to memory of 2036 868 wscript.exe ori40teleevery.exe PID 868 wrote to memory of 2036 868 wscript.exe ori40teleevery.exe PID 868 wrote to memory of 2036 868 wscript.exe ori40teleevery.exe PID 868 wrote to memory of 2036 868 wscript.exe ori40teleevery.exe -
outlook_office_path 1 IoCs
Processes:
ori40teleevery.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ori40teleevery.exe -
outlook_win_path 1 IoCs
Processes:
ori40teleevery.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ori40teleevery.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\SbPbhXXaAe_ori40teleevery.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\siiOXfeLhL.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\ori40teleevery.exe"C:\Users\Admin\AppData\Local\Temp\ori40teleevery.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ori40teleevery.exeFilesize
210KB
MD5e0f80223a94ccf3f36aa16c48514f692
SHA173d3bffd145250ce91657c9d4f3f53ca97c716c0
SHA256a56acb1d690ee4deccb5f33c846f767705d5b0a84b6ee0a77aea30c81aa9da67
SHA512d5ab5e0cc0399ccc0be06eb8813e4a481d81cd4c222fc7f4553c6f3d1c4b0433a18244626600ab903842da4d6db40e2430c5dcc96ed381b7d4b7f28fd29d6ad5
-
C:\Users\Admin\AppData\Local\Temp\ori40teleevery.exeFilesize
210KB
MD5e0f80223a94ccf3f36aa16c48514f692
SHA173d3bffd145250ce91657c9d4f3f53ca97c716c0
SHA256a56acb1d690ee4deccb5f33c846f767705d5b0a84b6ee0a77aea30c81aa9da67
SHA512d5ab5e0cc0399ccc0be06eb8813e4a481d81cd4c222fc7f4553c6f3d1c4b0433a18244626600ab903842da4d6db40e2430c5dcc96ed381b7d4b7f28fd29d6ad5
-
C:\Users\Admin\AppData\Roaming\siiOXfeLhL.jsFilesize
5KB
MD54231696592e958293b751bd32c1a6beb
SHA1648d61687cdc1c4b5cadda1df2fe643c31eb6f8b
SHA2563e95f65cac8ca73735d5af5ebe667926639810e99c9478d9c50c24426c51084b
SHA5121612f1654ed5c8a96470f96589f44a920dbee69468fa0bcd3135ed53beb3e3bfd92d845ab8c3f21253bc82eeca28af6f621e9833cdf2960dd8009b6bb2cdcafa
-
memory/868-54-0x000007FEFC041000-0x000007FEFC043000-memory.dmpFilesize
8KB
-
memory/2004-55-0x0000000000000000-mapping.dmp
-
memory/2036-57-0x0000000000000000-mapping.dmp
-
memory/2036-61-0x0000000001000000-0x000000000103A000-memory.dmpFilesize
232KB
-
memory/2036-62-0x0000000075DF1000-0x0000000075DF3000-memory.dmpFilesize
8KB