Analysis
-
max time kernel
91s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2022 07:39
Static task
static1
Behavioral task
behavioral1
Sample
0d46808ee6193515a12305f9b59352c7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0d46808ee6193515a12305f9b59352c7.exe
Resource
win10v2004-20220812-en
General
-
Target
0d46808ee6193515a12305f9b59352c7.exe
-
Size
730KB
-
MD5
0d46808ee6193515a12305f9b59352c7
-
SHA1
08e0bf06814fde6084d0e3d59e058aa95558d8fa
-
SHA256
21069f1228603fb512b24e1c9f58cf57b370d93b5f78b8b9628e93c9c79a5f7c
-
SHA512
8cc4f79e3ea3855705bceccce059a2fc232273700ad4c4ccb0825ad49bf0594bdfedb19babcc158a77e575ef90996ac57e23bb42f52af69b266e61c070616216
-
SSDEEP
12288:DIImSMXVbe1QFQ52ZP5wOxVHggEXyYDCKzTNfzqhtZXYIkm7Fy93kJSS/e:DIIkeMh5w2AgEXycJMtZYIkoFyn
Malware Config
Extracted
Protocol: smtp- Host:
smtp.mail.com - Port:
587 - Username:
[email protected] - Password:
SURE12345
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0d46808ee6193515a12305f9b59352c7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 0d46808ee6193515a12305f9b59352c7.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
0d46808ee6193515a12305f9b59352c7.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 0d46808ee6193515a12305f9b59352c7.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 0d46808ee6193515a12305f9b59352c7.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 0d46808ee6193515a12305f9b59352c7.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0d46808ee6193515a12305f9b59352c7.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Psgvpcy = "\"C:\\Users\\Admin\\AppData\\Roaming\\Gowcysodw\\Psgvpcy.exe\"" 0d46808ee6193515a12305f9b59352c7.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0d46808ee6193515a12305f9b59352c7.exedescription pid process target process PID 452 set thread context of 4460 452 0d46808ee6193515a12305f9b59352c7.exe 0d46808ee6193515a12305f9b59352c7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exe0d46808ee6193515a12305f9b59352c7.exepid process 4868 powershell.exe 4868 powershell.exe 4460 0d46808ee6193515a12305f9b59352c7.exe 4460 0d46808ee6193515a12305f9b59352c7.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exe0d46808ee6193515a12305f9b59352c7.exe0d46808ee6193515a12305f9b59352c7.exedescription pid process Token: SeDebugPrivilege 4868 powershell.exe Token: SeDebugPrivilege 452 0d46808ee6193515a12305f9b59352c7.exe Token: SeDebugPrivilege 4460 0d46808ee6193515a12305f9b59352c7.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
0d46808ee6193515a12305f9b59352c7.exedescription pid process target process PID 452 wrote to memory of 4868 452 0d46808ee6193515a12305f9b59352c7.exe powershell.exe PID 452 wrote to memory of 4868 452 0d46808ee6193515a12305f9b59352c7.exe powershell.exe PID 452 wrote to memory of 4868 452 0d46808ee6193515a12305f9b59352c7.exe powershell.exe PID 452 wrote to memory of 4460 452 0d46808ee6193515a12305f9b59352c7.exe 0d46808ee6193515a12305f9b59352c7.exe PID 452 wrote to memory of 4460 452 0d46808ee6193515a12305f9b59352c7.exe 0d46808ee6193515a12305f9b59352c7.exe PID 452 wrote to memory of 4460 452 0d46808ee6193515a12305f9b59352c7.exe 0d46808ee6193515a12305f9b59352c7.exe PID 452 wrote to memory of 4460 452 0d46808ee6193515a12305f9b59352c7.exe 0d46808ee6193515a12305f9b59352c7.exe PID 452 wrote to memory of 4460 452 0d46808ee6193515a12305f9b59352c7.exe 0d46808ee6193515a12305f9b59352c7.exe PID 452 wrote to memory of 4460 452 0d46808ee6193515a12305f9b59352c7.exe 0d46808ee6193515a12305f9b59352c7.exe PID 452 wrote to memory of 4460 452 0d46808ee6193515a12305f9b59352c7.exe 0d46808ee6193515a12305f9b59352c7.exe PID 452 wrote to memory of 4460 452 0d46808ee6193515a12305f9b59352c7.exe 0d46808ee6193515a12305f9b59352c7.exe -
outlook_office_path 1 IoCs
Processes:
0d46808ee6193515a12305f9b59352c7.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 0d46808ee6193515a12305f9b59352c7.exe -
outlook_win_path 1 IoCs
Processes:
0d46808ee6193515a12305f9b59352c7.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 0d46808ee6193515a12305f9b59352c7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d46808ee6193515a12305f9b59352c7.exe"C:\Users\Admin\AppData\Local\Temp\0d46808ee6193515a12305f9b59352c7.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\0d46808ee6193515a12305f9b59352c7.exeC:\Users\Admin\AppData\Local\Temp\0d46808ee6193515a12305f9b59352c7.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0d46808ee6193515a12305f9b59352c7.exe.logFilesize
1KB
MD57e88081fcf716d85992bb3af3d9b6454
SHA12153780fbc71061b0102a7a7b665349e1013e250
SHA2565ffb4a3ea94a6a53c4f88e2191c6fec5fd8a7336e367aa113fe8c12631e0c4d2
SHA512ec606e14367ae221c04f213a61a6f797034495121198e4788e3afa4aa8db67bf59c5c5210a56afae5557158e8923b013b371b84c7d64303618c5b4c57a2224f7
-
memory/452-133-0x0000000004DB0000-0x0000000004DD2000-memory.dmpFilesize
136KB
-
memory/452-132-0x0000000000180000-0x000000000023C000-memory.dmpFilesize
752KB
-
memory/4460-142-0x0000000000000000-mapping.dmp
-
memory/4460-149-0x0000000006B50000-0x0000000006B5A000-memory.dmpFilesize
40KB
-
memory/4460-148-0x0000000006BE0000-0x0000000006C72000-memory.dmpFilesize
584KB
-
memory/4460-147-0x00000000069F0000-0x0000000006A40000-memory.dmpFilesize
320KB
-
memory/4460-146-0x0000000005610000-0x00000000056AC000-memory.dmpFilesize
624KB
-
memory/4460-145-0x0000000005BC0000-0x0000000006164000-memory.dmpFilesize
5.6MB
-
memory/4460-143-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4868-136-0x0000000004CF0000-0x0000000005318000-memory.dmpFilesize
6.2MB
-
memory/4868-141-0x0000000005F70000-0x0000000005F8A000-memory.dmpFilesize
104KB
-
memory/4868-140-0x00000000070C0000-0x000000000773A000-memory.dmpFilesize
6.5MB
-
memory/4868-139-0x0000000005A60000-0x0000000005A7E000-memory.dmpFilesize
120KB
-
memory/4868-138-0x0000000005320000-0x0000000005386000-memory.dmpFilesize
408KB
-
memory/4868-137-0x0000000004B50000-0x0000000004BB6000-memory.dmpFilesize
408KB
-
memory/4868-135-0x00000000044F0000-0x0000000004526000-memory.dmpFilesize
216KB
-
memory/4868-134-0x0000000000000000-mapping.dmp