Analysis
-
max time kernel
144s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
submitted
22-09-2022 11:00
Behavioral task
behavioral1
Sample
afb480e4ad0324585f1bf3beec7b1b89729f2af125842dc2dab10565aa814abe.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
afb480e4ad0324585f1bf3beec7b1b89729f2af125842dc2dab10565aa814abe.exe
Resource
win10-20220812-en
windows10-1703-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
afb480e4ad0324585f1bf3beec7b1b89729f2af125842dc2dab10565aa814abe.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
afb480e4ad0324585f1bf3beec7b1b89729f2af125842dc2dab10565aa814abe.exe
Malware Config
Extracted
Family
agenttesla
C2
https://api.telegram.org/bot1884223853:AAFLYXw5-3W9k1k0nY-fyJeUEh7dhx5xk78/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 afb480e4ad0324585f1bf3beec7b1b89729f2af125842dc2dab10565aa814abe.exe Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 afb480e4ad0324585f1bf3beec7b1b89729f2af125842dc2dab10565aa814abe.exe Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 afb480e4ad0324585f1bf3beec7b1b89729f2af125842dc2dab10565aa814abe.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 1196 afb480e4ad0324585f1bf3beec7b1b89729f2af125842dc2dab10565aa814abe.exe 1196 afb480e4ad0324585f1bf3beec7b1b89729f2af125842dc2dab10565aa814abe.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1196 afb480e4ad0324585f1bf3beec7b1b89729f2af125842dc2dab10565aa814abe.exe Token: SeDebugPrivilege 1472 taskmgr.exe Token: SeSecurityPrivilege 1472 taskmgr.exe Token: SeTakeOwnershipPrivilege 1472 taskmgr.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
pid Process 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe 1472 taskmgr.exe -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 afb480e4ad0324585f1bf3beec7b1b89729f2af125842dc2dab10565aa814abe.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 afb480e4ad0324585f1bf3beec7b1b89729f2af125842dc2dab10565aa814abe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\afb480e4ad0324585f1bf3beec7b1b89729f2af125842dc2dab10565aa814abe.exe"C:\Users\Admin\AppData\Local\Temp\afb480e4ad0324585f1bf3beec7b1b89729f2af125842dc2dab10565aa814abe.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1196
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1472