Analysis
-
max time kernel
54s -
max time network
57s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-09-2022 14:44
Static task
static1
Behavioral task
behavioral1
Sample
Order No. I20220052.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Order No. I20220052.exe
Resource
win10v2004-20220812-en
General
-
Target
Order No. I20220052.exe
-
Size
755KB
-
MD5
f38b4a25807e902e044ec404d40ac51d
-
SHA1
c741b10d60d9e7fcd92b2eaf1307c2b2a93e49a2
-
SHA256
97402389904e8f2dce21eb51b5d80f9c45bfff592e7e6795703ebdb16f6740cc
-
SHA512
51925e659522673edb268017282302229f7fef0191c43c7c012ae27a9932b565eb6e9822f1eb5734a3a32dd69907f0f0c72c514b2a18131fc5612e88be9d027b
-
SSDEEP
12288:62xrADqjJ5nqCSojB2v+zV9cvrs8fP6mU36R950+9MK:Pjrqaj2IV9cvrs8Xq6Ze
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5357159221:AAEuOoQ0pUc4ccIZou0EJ5Zin0mMneE2jYg/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order No. I20220052.exedescription pid process target process PID 1088 set thread context of 1388 1088 Order No. I20220052.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 1388 RegSvcs.exe 1388 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1388 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Order No. I20220052.exedescription pid process target process PID 1088 wrote to memory of 1388 1088 Order No. I20220052.exe RegSvcs.exe PID 1088 wrote to memory of 1388 1088 Order No. I20220052.exe RegSvcs.exe PID 1088 wrote to memory of 1388 1088 Order No. I20220052.exe RegSvcs.exe PID 1088 wrote to memory of 1388 1088 Order No. I20220052.exe RegSvcs.exe PID 1088 wrote to memory of 1388 1088 Order No. I20220052.exe RegSvcs.exe PID 1088 wrote to memory of 1388 1088 Order No. I20220052.exe RegSvcs.exe PID 1088 wrote to memory of 1388 1088 Order No. I20220052.exe RegSvcs.exe PID 1088 wrote to memory of 1388 1088 Order No. I20220052.exe RegSvcs.exe PID 1088 wrote to memory of 1388 1088 Order No. I20220052.exe RegSvcs.exe PID 1088 wrote to memory of 1388 1088 Order No. I20220052.exe RegSvcs.exe PID 1088 wrote to memory of 1388 1088 Order No. I20220052.exe RegSvcs.exe PID 1088 wrote to memory of 1388 1088 Order No. I20220052.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order No. I20220052.exe"C:\Users\Admin\AppData\Local\Temp\Order No. I20220052.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1088-54-0x0000000000AB0000-0x0000000000B74000-memory.dmpFilesize
784KB
-
memory/1088-55-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB
-
memory/1088-56-0x00000000005B0000-0x00000000005D0000-memory.dmpFilesize
128KB
-
memory/1088-57-0x0000000004EF0000-0x0000000004F6E000-memory.dmpFilesize
504KB
-
memory/1088-58-0x0000000000670000-0x00000000006AA000-memory.dmpFilesize
232KB
-
memory/1388-59-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1388-60-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1388-62-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1388-63-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1388-64-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1388-65-0x000000000043598E-mapping.dmp
-
memory/1388-69-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1388-67-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB