Analysis
- max time kernel
144s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20220715-en - resource tags
- submitted
19/07/2022, 03:33
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.7612.exe
- Size 75KB
- Sample220719-d37m2ahhak
- SHA256 ae1f1bf92f637348e6c6dfe6b0f79ff8f542ceec0cc0acc45e99d2ac27177422
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.barqaab.com
-
Port
587
-
Username
-
Password
Great@999@
Extracted
-
asyncrat
-
0.5.7B
-
Default
-
127.0.0.1:6606
-
127.0.0.1:7707
-
127.0.0.1:8808
-
127.0.0.1:9128
-
127.0.0.1:9121
-
23.105.131.196:6606
-
23.105.131.196:7707
-
23.105.131.196:8808
-
23.105.131.196:9128
-
23.105.131.196:9121
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.barqaab.com
-
Port
587
-
Username
-
Password
Great@999@
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
- suricata: ET MALWARE AgentTesla Exfil Via SMTP
suricata: ET MALWARE AgentTesla Exfil Via SMTP
- Async RAT payload 3 IoCs
- Executes dropped EXE 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7612.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7612.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Tzeiflihhffqlyskuvnmueeshooter async - copy.exe"C:\Users\Admin\AppData\Local\Temp\Tzeiflihhffqlyskuvnmueeshooter async - copy.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Tzeiflihhffqlyskuvnmueeshooter async - copy.exe
Tzeiflihhffqlyskuvnmueeshooter async - copy.exe
memory/444-135-0x00000000033B0000-0x00000000033E6000-memory.dmp
memory/444-141-0x00000000081E0000-0x000000000885A000-memory.dmp
memory/444-142-0x0000000006E40000-0x0000000006E5A000-memory.dmp
memory/444-136-0x0000000005B00000-0x0000000006128000-memory.dmp
memory/444-137-0x00000000059C0000-0x00000000059E2000-memory.dmp
memory/444-138-0x00000000061A0000-0x0000000006206000-memory.dmp
memory/444-139-0x0000000006340000-0x00000000063A6000-memory.dmp
memory/444-140-0x0000000005740000-0x000000000575E000-memory.dmp
memory/772-133-0x0000000005830000-0x000000000583A000-memory.dmp
memory/772-130-0x0000000000E90000-0x0000000000EA8000-memory.dmp
memory/772-132-0x00000000058F0000-0x0000000005982000-memory.dmp
memory/772-131-0x0000000005EA0000-0x0000000006444000-memory.dmp
memory/2000-148-0x0000000000400000-0x000000000043A000-memory.dmp
memory/2000-149-0x0000000005590000-0x000000000562C000-memory.dmp
memory/2000-150-0x0000000006990000-0x00000000069E0000-memory.dmp
memory/2100-146-0x0000000000150000-0x0000000000162000-memory.dmp