Analysis
-
max time kernel
53s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-10-2022 03:22
Static task
static1
Behavioral task
behavioral1
Sample
9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe
Resource
win10v2004-20220812-en
General
-
Target
9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe
-
Size
1.2MB
-
MD5
ce8f7848c768c7db0cb93126e3a53c15
-
SHA1
672e04fd85105dc26fd6ba8b798f79dc1eb7ff04
-
SHA256
9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40
-
SHA512
c1d0e096b5327537f753facda3fdc26a9a0b45e4b1cca3356d2d7f4131e0c6ebb04b11c1961a415548617f6ef37a20557ede092f69350440b158947db8cb6c91
-
SSDEEP
12288:Dxa2iNp68hzeFqPFCwflmsGNv+l4Y2+jvbL1YzYPqfIGYVpyADqjJ5nX:A1pwgmBNzQjvb+SNWjrX
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5662683474:AAFvSjyPXTiwhBPcFi8of3_-_FCdfhhN8x0/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exedescription pid process target process PID 1100 set thread context of 1716 1100 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exepid process 1100 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe 1716 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe 1716 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exedescription pid process Token: SeDebugPrivilege 1100 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe Token: SeDebugPrivilege 1716 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exedescription pid process target process PID 1100 wrote to memory of 1248 1100 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe schtasks.exe PID 1100 wrote to memory of 1248 1100 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe schtasks.exe PID 1100 wrote to memory of 1248 1100 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe schtasks.exe PID 1100 wrote to memory of 1248 1100 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe schtasks.exe PID 1100 wrote to memory of 1716 1100 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe PID 1100 wrote to memory of 1716 1100 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe PID 1100 wrote to memory of 1716 1100 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe PID 1100 wrote to memory of 1716 1100 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe PID 1100 wrote to memory of 1716 1100 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe PID 1100 wrote to memory of 1716 1100 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe PID 1100 wrote to memory of 1716 1100 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe PID 1100 wrote to memory of 1716 1100 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe PID 1100 wrote to memory of 1716 1100 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe -
outlook_office_path 1 IoCs
Processes:
9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe -
outlook_win_path 1 IoCs
Processes:
9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe"C:\Users\Admin\AppData\Local\Temp\9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dOfndS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp76C6.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\9dca638219e066e03580c78ee2911a9a15945f9585861451703ff0b0ac73eb40.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp76C6.tmpFilesize
1KB
MD5e8bd0b96d0856decf07d4273d864e7ce
SHA1e77b9b9c8ecf2a87cf69b262c93f303b1c0640d2
SHA2563d00b78b0f268c6cae9447ee8ad9c76a907a1c5ba5bf3a1c5a2e7ceeab7c7f5f
SHA5120e13219f25d6b8b323daba35bb3ae0edaf789eab2550f0e067c54907cc8fcd5b74db97ae520703dffda5c84525184bb252a208e4c75bc2650f1b5c39758b461e
-
memory/1100-57-0x0000000005400000-0x00000000054B2000-memory.dmpFilesize
712KB
-
memory/1100-56-0x00000000004B0000-0x00000000004D0000-memory.dmpFilesize
128KB
-
memory/1100-54-0x0000000000B20000-0x0000000000C4C000-memory.dmpFilesize
1.2MB
-
memory/1100-58-0x00000000054B0000-0x000000000551C000-memory.dmpFilesize
432KB
-
memory/1100-55-0x00000000763F1000-0x00000000763F3000-memory.dmpFilesize
8KB
-
memory/1248-59-0x0000000000000000-mapping.dmp
-
memory/1716-62-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1716-61-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1716-64-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1716-65-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1716-67-0x000000000043599E-mapping.dmp
-
memory/1716-66-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1716-69-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1716-71-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB