Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
03-10-2022 01:16
Static task
static1
Behavioral task
behavioral1
Sample
1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe
Resource
win10-20220812-en
General
-
Target
1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe
-
Size
988KB
-
MD5
ea43ffe83e034789486180bf42438e98
-
SHA1
2b8b3334c5c868bbb69ccd25c0ddefd6d4a89af5
-
SHA256
1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411
-
SHA512
1205d69c02a55280fcd85897ddcbc797e2395189bb9d0dbd1f5fbd394c5d3d9a339da6b77dba8a3f44d113cffc8a4f308f564f9e3f3f1d4546810c8ec0de9e87
-
SSDEEP
12288:k5rYiKbQg50+EE1UzRp1gSYpZqHDuz+mNe0wPYFTvDz2K4HTN:EraQO1/agpZqHDuz+QeaT3
Malware Config
Extracted
Protocol: ftp- Host:
ftp.valvulasthermovalve.cl - Port:
21 - Username:
cva19491@valvulasthermovalve.cl - Password:
LILKOOLL14!!
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exedescription pid process target process PID 4952 set thread context of 3732 4952 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exepid process 3732 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe 3732 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exedescription pid process Token: SeDebugPrivilege 3732 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exedescription pid process target process PID 4952 wrote to memory of 3732 4952 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe PID 4952 wrote to memory of 3732 4952 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe PID 4952 wrote to memory of 3732 4952 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe PID 4952 wrote to memory of 3732 4952 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe PID 4952 wrote to memory of 3732 4952 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe PID 4952 wrote to memory of 3732 4952 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe PID 4952 wrote to memory of 3732 4952 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe PID 4952 wrote to memory of 3732 4952 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe -
outlook_office_path 1 IoCs
Processes:
1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe -
outlook_win_path 1 IoCs
Processes:
1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe"C:\Users\Admin\AppData\Local\Temp\1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe"C:\Users\Admin\AppData\Local\Temp\1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1e82e7a579c595f8c442e5f993cba0bcef4fad6cd9cf3c64f4dfc6518682c411.exe.logFilesize
1KB
MD512557ab909651a6f99d3503d614d3562
SHA1b86745768059a514bea3a438e1e96086af463246
SHA2569589c869703e95d40d5870c60f66d8460f7914e9fe8dd579533c84148112babd
SHA51210cdb2fa7cf054af937b4aeddfe16fe755d6b09db5a51f7052adbf472b4b435e16c141f3712762f3b67f990c3efcfa47659576988e321214c747d6cd98e75521
-
memory/3732-187-0x0000000000435BCE-mapping.dmp
-
memory/3732-186-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3732-188-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3732-189-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3732-190-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/3732-247-0x0000000004FD0000-0x0000000004FE8000-memory.dmpFilesize
96KB
-
memory/4952-149-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-123-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-119-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-121-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-122-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-153-0x0000000004A20000-0x0000000004AB2000-memory.dmpFilesize
584KB
-
memory/4952-124-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-125-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-126-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-127-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-154-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-129-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-130-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-131-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-132-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-133-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-134-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-135-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-136-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-137-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-138-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-139-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-140-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-141-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-143-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-142-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-144-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-145-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-146-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-152-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-148-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-118-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-150-0x00000000000F0000-0x00000000001EA000-memory.dmpFilesize
1000KB
-
memory/4952-151-0x0000000004E80000-0x000000000537E000-memory.dmpFilesize
5.0MB
-
memory/4952-147-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-120-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-128-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-155-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-156-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-157-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-158-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-159-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-160-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-161-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-162-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-163-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-164-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-165-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-166-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-167-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-168-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-169-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-170-0x00000000049F0000-0x00000000049FA000-memory.dmpFilesize
40KB
-
memory/4952-171-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-172-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-173-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-174-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-175-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-176-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-177-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-178-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-179-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-180-0x0000000007790000-0x00000000077AC000-memory.dmpFilesize
112KB
-
memory/4952-117-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-116-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4952-181-0x0000000007A30000-0x0000000007A3C000-memory.dmpFilesize
48KB
-
memory/4952-182-0x0000000007AD0000-0x0000000007B64000-memory.dmpFilesize
592KB
-
memory/4952-183-0x0000000007C20000-0x0000000007CBC000-memory.dmpFilesize
624KB
-
memory/4952-184-0x0000000007D30000-0x0000000007D96000-memory.dmpFilesize
408KB
-
memory/4952-185-0x0000000007BD0000-0x0000000007C0A000-memory.dmpFilesize
232KB