Analysis
- max time kernel
120s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
01/07/2022, 03:30
General
- Target e5ba5561a595f111ed5ebfc11ce700b12f0736beab9638acd2403c35620d68fd.exe
- Size 1000KB
- Sample220701-d2td1scaf9
- SHA256 e5ba5561a595f111ed5ebfc11ce700b12f0736beab9638acd2403c35620d68fd
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
us2.smtp.mailhostbox.com
-
Port
587
-
Username
-
Password
Ogheneronano1984
Extracted
-
formbook
-
3.9
-
s0s
-
hspip.com
-
futur-sound-pc.com
-
miamilakesholistictherapy.com
-
pj66638.com
-
artecesped.com
-
best-voices.com
-
kingsof3d.com
-
scupcountry.com
-
diachinganhang.com
-
stl2ca.com
-
quickshotfirearms.com
-
ezhdpl.info
-
innografica.com
-
simbascfans.com
-
wlgj66.com
-
slybufordzsl.com
-
8gcex90k1.biz
-
bnewskolhapur.com
-
okaygotour.com
-
xboxcheap.com
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- AgentTesla Payload 2 IoCs
- Formbook Payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5ba5561a595f111ed5ebfc11ce700b12f0736beab9638acd2403c35620d68fd.exe"C:\Users\Admin\AppData\Local\Temp\e5ba5561a595f111ed5ebfc11ce700b12f0736beab9638acd2403c35620d68fd.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e5ba5561a595f111ed5ebfc11ce700b12f0736beab9638acd2403c35620d68fd.exe"C:\Users\Admin\AppData\Local\Temp\e5ba5561a595f111ed5ebfc11ce700b12f0736beab9638acd2403c35620d68fd.exe"2⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\MR.FESTUS ORIGIN RAWFILE.exe"C:\Users\Admin\MR.FESTUS ORIGIN RAWFILE.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
MR.FESTUS ORIGIN RAWFILE.exe
MR.FESTUS ORIGIN RAWFILE.exe
win.ini
memory/1344-147-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1344-148-0x0000000020450000-0x000000002079A000-memory.dmp
memory/1344-139-0x00000000021C0000-0x00000000021C7000-memory.dmp
memory/1344-140-0x00007FFD6AC30000-0x00007FFD6AE25000-memory.dmp
memory/1344-141-0x0000000077DD0000-0x0000000077F73000-memory.dmp
memory/1344-142-0x0000000077DD0000-0x0000000077F73000-memory.dmp
memory/1344-151-0x0000000077DD0000-0x0000000077F73000-memory.dmp
memory/1344-150-0x00000000021C0000-0x00000000021C7000-memory.dmp
memory/1344-146-0x0000000000400000-0x00000000004FD000-memory.dmp
memory/4540-136-0x0000000002190000-0x0000000002197000-memory.dmp
memory/4540-138-0x0000000077DD0000-0x0000000077F73000-memory.dmp
memory/4540-137-0x00007FFD6AC30000-0x00007FFD6AE25000-memory.dmp
memory/4984-149-0x0000000073C00000-0x00000000741B1000-memory.dmp
memory/4984-152-0x0000000073C00000-0x00000000741B1000-memory.dmp