Analysis
-
max time kernel
97s -
max time network
84s -
platform
windows7_x64 -
resource
win7-20220812-en -
submitted
21-09-2022 18:54
Static task
static1
Behavioral task
behavioral1
Sample
Curr¡culum Vitae Rita.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Curr¡culum Vitae Rita.exe
Resource
win10v2004-20220812-en
General
-
Target
Curr¡culum Vitae Rita.exe
-
Size
1.0MB
-
MD5
ec74c708001090117278d032f8342453
-
SHA1
f34edd03b9072dff0cbc4bfbeff2c18b98a6933e
-
SHA256
720d90ad498171d943399e010d4aa16cc65f69bbff6f042d6b364813cfd168bb
-
SHA512
1c7a867bd4b29ac7f83b9a406e979bc3715561dfd4d65c4378a6d7c17c96745a915f1e7e4aee8de2a2b35dca0a2c7a2c1c7ed0d6e278d30377a21cde717fcbd4
-
SSDEEP
12288:DBluwyS7oLFMrfbIT7TNIOEbRbNmu3ROUKCeKowyaqfpPWla:tlFEFMrEHpIdbcqRnKDKo1pP+a
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5700681005:AAF2K-iQMsKRkqCcUgSZLmmugrKJcbb8Xg8/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Curr¡culum Vitae Rita.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Curr¡culum Vitae Rita.exe Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Curr¡culum Vitae Rita.exe Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Curr¡culum Vitae Rita.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Curr¡culum Vitae Rita.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpDaTe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\UpDaTe\\UpDaTe.exe" Curr¡culum Vitae Rita.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Curr¡culum Vitae Rita.exedescription pid process target process PID 900 set thread context of 1900 900 Curr¡culum Vitae Rita.exe Curr¡culum Vitae Rita.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Curr¡culum Vitae Rita.exeCurr¡culum Vitae Rita.exepid process 900 Curr¡culum Vitae Rita.exe 900 Curr¡culum Vitae Rita.exe 900 Curr¡culum Vitae Rita.exe 900 Curr¡culum Vitae Rita.exe 900 Curr¡culum Vitae Rita.exe 900 Curr¡culum Vitae Rita.exe 900 Curr¡culum Vitae Rita.exe 900 Curr¡culum Vitae Rita.exe 1900 Curr¡culum Vitae Rita.exe 1900 Curr¡culum Vitae Rita.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Curr¡culum Vitae Rita.exeCurr¡culum Vitae Rita.exedescription pid process Token: SeDebugPrivilege 900 Curr¡culum Vitae Rita.exe Token: SeDebugPrivilege 1900 Curr¡culum Vitae Rita.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Curr¡culum Vitae Rita.exedescription pid process target process PID 900 wrote to memory of 2000 900 Curr¡culum Vitae Rita.exe Curr¡culum Vitae Rita.exe PID 900 wrote to memory of 2000 900 Curr¡culum Vitae Rita.exe Curr¡culum Vitae Rita.exe PID 900 wrote to memory of 2000 900 Curr¡culum Vitae Rita.exe Curr¡culum Vitae Rita.exe PID 900 wrote to memory of 2000 900 Curr¡culum Vitae Rita.exe Curr¡culum Vitae Rita.exe PID 900 wrote to memory of 1900 900 Curr¡culum Vitae Rita.exe Curr¡culum Vitae Rita.exe PID 900 wrote to memory of 1900 900 Curr¡culum Vitae Rita.exe Curr¡culum Vitae Rita.exe PID 900 wrote to memory of 1900 900 Curr¡culum Vitae Rita.exe Curr¡culum Vitae Rita.exe PID 900 wrote to memory of 1900 900 Curr¡culum Vitae Rita.exe Curr¡culum Vitae Rita.exe PID 900 wrote to memory of 1900 900 Curr¡culum Vitae Rita.exe Curr¡culum Vitae Rita.exe PID 900 wrote to memory of 1900 900 Curr¡culum Vitae Rita.exe Curr¡culum Vitae Rita.exe PID 900 wrote to memory of 1900 900 Curr¡culum Vitae Rita.exe Curr¡culum Vitae Rita.exe PID 900 wrote to memory of 1900 900 Curr¡culum Vitae Rita.exe Curr¡culum Vitae Rita.exe PID 900 wrote to memory of 1900 900 Curr¡culum Vitae Rita.exe Curr¡culum Vitae Rita.exe -
outlook_office_path 1 IoCs
Processes:
Curr¡culum Vitae Rita.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Curr¡culum Vitae Rita.exe -
outlook_win_path 1 IoCs
Processes:
Curr¡culum Vitae Rita.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Curr¡culum Vitae Rita.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Curr¡culum Vitae Rita.exe"C:\Users\Admin\AppData\Local\Temp\Curr¡culum Vitae Rita.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Curr¡culum Vitae Rita.exe"C:\Users\Admin\AppData\Local\Temp\Curr¡culum Vitae Rita.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Curr¡culum Vitae Rita.exe"C:\Users\Admin\AppData\Local\Temp\Curr¡culum Vitae Rita.exe"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/900-54-0x00000000012C0000-0x00000000013D0000-memory.dmpFilesize
1.1MB
-
memory/900-55-0x0000000076121000-0x0000000076123000-memory.dmpFilesize
8KB
-
memory/900-56-0x0000000000460000-0x0000000000474000-memory.dmpFilesize
80KB
-
memory/900-57-0x0000000000470000-0x000000000047C000-memory.dmpFilesize
48KB
-
memory/900-58-0x0000000006000000-0x0000000006094000-memory.dmpFilesize
592KB
-
memory/900-59-0x0000000006090000-0x00000000060CA000-memory.dmpFilesize
232KB
-
memory/1900-60-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1900-61-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1900-63-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1900-64-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1900-65-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1900-66-0x0000000000435AEE-mapping.dmp
-
memory/1900-70-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1900-68-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB