Analysis
- max time kernel
139s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
- submitted
27/07/2022, 04:47
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.30362.exe
- Size 976KB
- Sample220727-fejbmsacfp
- SHA256 64d8e5fd70d710d77cc38992cc5b9f7a23757e0cf5f0fc6399f53cb160154f74
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.huiijingco.com
-
Port
587
-
Username
-
Password
lNLUrZT2
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla payload 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/424-155-0x00000000066C0000-0x0000000006710000-memory.dmp
memory/424-143-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2056-141-0x0000000005FE0000-0x0000000006046000-memory.dmp
memory/2056-144-0x0000000006690000-0x00000000066AE000-memory.dmp
memory/2056-154-0x0000000007CB0000-0x0000000007CB8000-memory.dmp
memory/2056-137-0x0000000005100000-0x0000000005136000-memory.dmp
memory/2056-138-0x00000000058B0000-0x0000000005ED8000-memory.dmp
memory/2056-139-0x00000000056F0000-0x0000000005712000-memory.dmp
memory/2056-153-0x0000000007CD0000-0x0000000007CEA000-memory.dmp
memory/2056-152-0x0000000007BC0000-0x0000000007BCE000-memory.dmp
memory/2056-151-0x0000000007C10000-0x0000000007CA6000-memory.dmp
memory/2056-150-0x0000000007A10000-0x0000000007A1A000-memory.dmp
memory/2056-149-0x0000000007990000-0x00000000079AA000-memory.dmp
memory/2056-145-0x0000000006C60000-0x0000000006C92000-memory.dmp
memory/2056-146-0x0000000074E00000-0x0000000074E4C000-memory.dmp
memory/2056-147-0x0000000006C40000-0x0000000006C5E000-memory.dmp
memory/2056-148-0x0000000007FE0000-0x000000000865A000-memory.dmp
memory/4300-134-0x0000000007750000-0x00000000077EC000-memory.dmp
memory/4300-130-0x0000000000A10000-0x0000000000B08000-memory.dmp
memory/4300-132-0x0000000005500000-0x0000000005592000-memory.dmp
memory/4300-133-0x00000000054B0000-0x00000000054BA000-memory.dmp
memory/4300-135-0x000000000B550000-0x000000000B5B6000-memory.dmp
memory/4300-131-0x0000000005AB0000-0x0000000006054000-memory.dmp