Analysis
-
max time kernel
138s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 08:38
Static task
static1
Behavioral task
behavioral1
Sample
d26c8282cb80ad25f07b769fb2152dff.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d26c8282cb80ad25f07b769fb2152dff.exe
Resource
win10v2004-20220901-en
General
-
Target
d26c8282cb80ad25f07b769fb2152dff.exe
-
Size
988KB
-
MD5
d26c8282cb80ad25f07b769fb2152dff
-
SHA1
a3f42a6f49f6219b3a5ba9e2f3ac3b80f7beee78
-
SHA256
3e8538df66efc0c110ba8bca5f3f6e02aefe24f80f622b97731f46f958803f86
-
SHA512
c3353e58905087155744fc25c978a61f28069d8108fe8fec971bdcaf58cb51ae193b6bd45005132250adc27e27b3ec1e4141c708267274d4738427c7f1329388
-
SSDEEP
12288:2S/nb8oh1rgtC0DagQY+5pJIUkjErhAQOV3a810F9+OToal1K4HTN:38ekagU5I5iAQO1CJl
Malware Config
Extracted
Protocol: ftp- Host:
192.3.223.202 - Port:
21 - Username:
ftplogs - Password:
sPkZ7jK7P6aA
Extracted
agenttesla
Protocol: ftp- Host:
ftp://192.3.223.202 - Port:
21 - Username:
ftplogs - Password:
sPkZ7jK7P6aA
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d26c8282cb80ad25f07b769fb2152dff.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation d26c8282cb80ad25f07b769fb2152dff.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
d26c8282cb80ad25f07b769fb2152dff.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d26c8282cb80ad25f07b769fb2152dff.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d26c8282cb80ad25f07b769fb2152dff.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d26c8282cb80ad25f07b769fb2152dff.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
d26c8282cb80ad25f07b769fb2152dff.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hZpzJs = "C:\\Users\\Admin\\AppData\\Roaming\\hZpzJs\\hZpzJs.exe" d26c8282cb80ad25f07b769fb2152dff.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d26c8282cb80ad25f07b769fb2152dff.exedescription pid process target process PID 2212 set thread context of 3048 2212 d26c8282cb80ad25f07b769fb2152dff.exe d26c8282cb80ad25f07b769fb2152dff.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
d26c8282cb80ad25f07b769fb2152dff.exepowershell.exed26c8282cb80ad25f07b769fb2152dff.exepid process 2212 d26c8282cb80ad25f07b769fb2152dff.exe 2212 d26c8282cb80ad25f07b769fb2152dff.exe 3588 powershell.exe 3048 d26c8282cb80ad25f07b769fb2152dff.exe 3048 d26c8282cb80ad25f07b769fb2152dff.exe 3588 powershell.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
d26c8282cb80ad25f07b769fb2152dff.exepid process 3048 d26c8282cb80ad25f07b769fb2152dff.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
d26c8282cb80ad25f07b769fb2152dff.exepowershell.exed26c8282cb80ad25f07b769fb2152dff.exedescription pid process Token: SeDebugPrivilege 2212 d26c8282cb80ad25f07b769fb2152dff.exe Token: SeDebugPrivilege 3588 powershell.exe Token: SeDebugPrivilege 3048 d26c8282cb80ad25f07b769fb2152dff.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
d26c8282cb80ad25f07b769fb2152dff.exedescription pid process target process PID 2212 wrote to memory of 3588 2212 d26c8282cb80ad25f07b769fb2152dff.exe powershell.exe PID 2212 wrote to memory of 3588 2212 d26c8282cb80ad25f07b769fb2152dff.exe powershell.exe PID 2212 wrote to memory of 3588 2212 d26c8282cb80ad25f07b769fb2152dff.exe powershell.exe PID 2212 wrote to memory of 4788 2212 d26c8282cb80ad25f07b769fb2152dff.exe schtasks.exe PID 2212 wrote to memory of 4788 2212 d26c8282cb80ad25f07b769fb2152dff.exe schtasks.exe PID 2212 wrote to memory of 4788 2212 d26c8282cb80ad25f07b769fb2152dff.exe schtasks.exe PID 2212 wrote to memory of 3048 2212 d26c8282cb80ad25f07b769fb2152dff.exe d26c8282cb80ad25f07b769fb2152dff.exe PID 2212 wrote to memory of 3048 2212 d26c8282cb80ad25f07b769fb2152dff.exe d26c8282cb80ad25f07b769fb2152dff.exe PID 2212 wrote to memory of 3048 2212 d26c8282cb80ad25f07b769fb2152dff.exe d26c8282cb80ad25f07b769fb2152dff.exe PID 2212 wrote to memory of 3048 2212 d26c8282cb80ad25f07b769fb2152dff.exe d26c8282cb80ad25f07b769fb2152dff.exe PID 2212 wrote to memory of 3048 2212 d26c8282cb80ad25f07b769fb2152dff.exe d26c8282cb80ad25f07b769fb2152dff.exe PID 2212 wrote to memory of 3048 2212 d26c8282cb80ad25f07b769fb2152dff.exe d26c8282cb80ad25f07b769fb2152dff.exe PID 2212 wrote to memory of 3048 2212 d26c8282cb80ad25f07b769fb2152dff.exe d26c8282cb80ad25f07b769fb2152dff.exe PID 2212 wrote to memory of 3048 2212 d26c8282cb80ad25f07b769fb2152dff.exe d26c8282cb80ad25f07b769fb2152dff.exe -
outlook_office_path 1 IoCs
Processes:
d26c8282cb80ad25f07b769fb2152dff.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d26c8282cb80ad25f07b769fb2152dff.exe -
outlook_win_path 1 IoCs
Processes:
d26c8282cb80ad25f07b769fb2152dff.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d26c8282cb80ad25f07b769fb2152dff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d26c8282cb80ad25f07b769fb2152dff.exe"C:\Users\Admin\AppData\Local\Temp\d26c8282cb80ad25f07b769fb2152dff.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JeHBvjHuYEfr.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JeHBvjHuYEfr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp590D.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\d26c8282cb80ad25f07b769fb2152dff.exe"C:\Users\Admin\AppData\Local\Temp\d26c8282cb80ad25f07b769fb2152dff.exe"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d26c8282cb80ad25f07b769fb2152dff.exe.logFilesize
1KB
MD5e08f822522c617a40840c62e4b0fb45e
SHA1ae516dca4da5234be6676d3f234c19ec55725be7
SHA256bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7
SHA512894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4
-
C:\Users\Admin\AppData\Local\Temp\tmp590D.tmpFilesize
1KB
MD5eb8bfa3296bc1fba7f731fd2d9d7f25a
SHA10da9edeb101ccc11847dcc5c647445c2b06201f4
SHA2564c6edd709ea7336e7a9da93752310d6a8ce4bbcbb37f2068a41027c3d977beee
SHA51247cb60879b1dfe939d783a91946a809388a26ed43b44c68063309f5205c2407a5dbe6be9225495d0589ea06e78b22ab3e1a530ddd6f77471d419c11b92f86d40
-
memory/2212-133-0x0000000005750000-0x0000000005CF4000-memory.dmpFilesize
5.6MB
-
memory/2212-134-0x00000000051A0000-0x0000000005232000-memory.dmpFilesize
584KB
-
memory/2212-135-0x0000000005120000-0x000000000512A000-memory.dmpFilesize
40KB
-
memory/2212-136-0x0000000008250000-0x00000000082EC000-memory.dmpFilesize
624KB
-
memory/2212-137-0x0000000008560000-0x00000000085C6000-memory.dmpFilesize
408KB
-
memory/2212-132-0x00000000007E0000-0x00000000008DA000-memory.dmpFilesize
1000KB
-
memory/3048-144-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3048-156-0x0000000006720000-0x0000000006770000-memory.dmpFilesize
320KB
-
memory/3048-143-0x0000000000000000-mapping.dmp
-
memory/3588-153-0x0000000006EB0000-0x0000000006ECA000-memory.dmpFilesize
104KB
-
memory/3588-152-0x00000000074F0000-0x0000000007B6A000-memory.dmpFilesize
6.5MB
-
memory/3588-140-0x00000000045E0000-0x0000000004616000-memory.dmpFilesize
216KB
-
memory/3588-146-0x0000000004C20000-0x0000000004C42000-memory.dmpFilesize
136KB
-
memory/3588-147-0x0000000005510000-0x0000000005576000-memory.dmpFilesize
408KB
-
memory/3588-148-0x0000000005BB0000-0x0000000005BCE000-memory.dmpFilesize
120KB
-
memory/3588-149-0x0000000006160000-0x0000000006192000-memory.dmpFilesize
200KB
-
memory/3588-150-0x0000000070D80000-0x0000000070DCC000-memory.dmpFilesize
304KB
-
memory/3588-151-0x0000000006140000-0x000000000615E000-memory.dmpFilesize
120KB
-
memory/3588-142-0x0000000004C70000-0x0000000005298000-memory.dmpFilesize
6.2MB
-
memory/3588-159-0x00000000071D0000-0x00000000071D8000-memory.dmpFilesize
32KB
-
memory/3588-154-0x0000000006F20000-0x0000000006F2A000-memory.dmpFilesize
40KB
-
memory/3588-155-0x0000000007130000-0x00000000071C6000-memory.dmpFilesize
600KB
-
memory/3588-138-0x0000000000000000-mapping.dmp
-
memory/3588-157-0x00000000070E0000-0x00000000070EE000-memory.dmpFilesize
56KB
-
memory/3588-158-0x00000000071F0000-0x000000000720A000-memory.dmpFilesize
104KB
-
memory/4788-139-0x0000000000000000-mapping.dmp