Analysis
-
max time kernel
52s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
03-10-2022 08:43
Static task
static1
Behavioral task
behavioral1
Sample
d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe
Resource
win10-20220901-en
General
-
Target
d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe
-
Size
523KB
-
MD5
53b9e0fde66e12f4fed9b8387552e1d2
-
SHA1
bab7a3747119c6a157798bdd1113940d50071cd7
-
SHA256
d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63
-
SHA512
e42403f031086c39bd1024619a7296260a350537f80aa20e4a136165e20504f6e1aaf375c887dac78325ef21fd1de2dd74507fd95bd4a5b37147672cb1b03ca3
-
SSDEEP
12288:yL5b2iN5ce0gNstVxuGJHHyp6Eh3CqAs3E:uh1TcZptSsHMG
Malware Config
Extracted
Protocol: smtp- Host:
mail.eyeshop.co.za - Port:
587 - Username:
reynoridge@eyeshop.co.za - Password:
eyeS@p0
Extracted
agenttesla
Protocol: smtp- Host:
mail.eyeshop.co.za - Port:
587 - Username:
reynoridge@eyeshop.co.za - Password:
eyeS@p0 - Email To:
xqalloys@gmail.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops file in Drivers directory 1 IoCs
Processes:
d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exedescription pid process target process PID 2796 set thread context of 3392 2796 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exed2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exepid process 2796 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe 2796 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe 3392 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe 3392 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exed2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exedescription pid process Token: SeDebugPrivilege 2796 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe Token: SeDebugPrivilege 3392 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exedescription pid process target process PID 2796 wrote to memory of 1108 2796 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe PID 2796 wrote to memory of 1108 2796 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe PID 2796 wrote to memory of 1108 2796 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe PID 2796 wrote to memory of 3392 2796 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe PID 2796 wrote to memory of 3392 2796 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe PID 2796 wrote to memory of 3392 2796 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe PID 2796 wrote to memory of 3392 2796 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe PID 2796 wrote to memory of 3392 2796 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe PID 2796 wrote to memory of 3392 2796 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe PID 2796 wrote to memory of 3392 2796 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe PID 2796 wrote to memory of 3392 2796 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe -
outlook_office_path 1 IoCs
Processes:
d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe -
outlook_win_path 1 IoCs
Processes:
d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe"C:\Users\Admin\AppData\Local\Temp\d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe"{path}"2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d2bfb8991bcbbae16022097161db1188c7f3ad19bdebe029fbfe803afad45f63.exe.logFilesize
1KB
MD5c3cc52ccca9ff2b6fa8d267fc350ca6b
SHA1a68d4028333296d222e4afd75dea36fdc98d05f3
SHA2563125b6071e2d78f575a06ed7ac32a83d9262ae64d1fa81ac43e8bfc1ef157c0e
SHA512b0c7b2501b1a2c559795a9d178c0bbda0e03cbdbaaa2c4330ac1202a55373fe1b742078adcfa915bd6e805565a2daa6d35d64ef7a14ffcd09069f9ea6a691cc7
-
memory/2796-120-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-121-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-122-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-123-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-124-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-125-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-126-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-127-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-128-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-129-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-130-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-131-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-132-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-133-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-134-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-135-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-136-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-137-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-138-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-139-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-140-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-141-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-142-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-143-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-144-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-145-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-146-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-147-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-148-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-149-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-150-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-151-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-152-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-153-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-154-0x0000000000120000-0x00000000001A8000-memory.dmpFilesize
544KB
-
memory/2796-155-0x0000000004FB0000-0x00000000054AE000-memory.dmpFilesize
5.0MB
-
memory/2796-156-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-157-0x0000000004AB0000-0x0000000004B42000-memory.dmpFilesize
584KB
-
memory/2796-158-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-159-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-160-0x0000000004B50000-0x0000000004BEC000-memory.dmpFilesize
624KB
-
memory/2796-161-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-162-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-163-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-164-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-165-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-166-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-167-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-168-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-169-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-170-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-171-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-172-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-173-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-174-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-175-0x0000000004A80000-0x0000000004A8A000-memory.dmpFilesize
40KB
-
memory/2796-176-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-177-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-178-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-179-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-180-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-181-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-182-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-183-0x0000000004F90000-0x0000000004FB0000-memory.dmpFilesize
128KB
-
memory/2796-184-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-185-0x0000000007CA0000-0x0000000007D1A000-memory.dmpFilesize
488KB
-
memory/2796-186-0x0000000007D70000-0x0000000007DAA000-memory.dmpFilesize
232KB
-
memory/2796-187-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/2796-192-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/3392-188-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3392-189-0x0000000000435D2E-mapping.dmp
-
memory/3392-190-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/3392-191-0x0000000077570000-0x00000000776FE000-memory.dmpFilesize
1.6MB
-
memory/3392-249-0x00000000051D0000-0x00000000051E8000-memory.dmpFilesize
96KB
-
memory/3392-251-0x0000000005D30000-0x0000000005D96000-memory.dmpFilesize
408KB