Analysis
-
max time kernel
66s -
max time network
70s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
03-10-2022 09:23
Static task
static1
Behavioral task
behavioral1
Sample
943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe
Resource
win10-20220812-en
General
-
Target
943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe
-
Size
888KB
-
MD5
9a9cb1f7f37aa3955cfb4d8991583e31
-
SHA1
8d63b02db5ce9bb9bb1691ab4a5282d18078191a
-
SHA256
943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b
-
SHA512
d018ecbd1cb1cea36a4e24e30525e64a1e44d0505859de1dcb93511d2e5a77f508ed0284114387da67dfcb0294d5bd15e5cf9d8629adc99e013660affa2dbac4
-
SSDEEP
12288:kK4HTNWk67oi/z0xXi5nv9OZT5fEKD501+owI73IskA2IaBunfuEhp+0:ME4xgv9OjbD/owE3IsH2cnmS
Malware Config
Extracted
Protocol: ftp- Host:
ftp.valvulasthermovalve.cl - Port:
21 - Username:
cva19491@valvulasthermovalve.cl - Password:
LILKOOLL14!!
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exedescription pid process target process PID 2972 set thread context of 3552 2972 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exepid process 3552 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe 3552 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exedescription pid process Token: SeDebugPrivilege 3552 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exedescription pid process target process PID 2972 wrote to memory of 3552 2972 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe PID 2972 wrote to memory of 3552 2972 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe PID 2972 wrote to memory of 3552 2972 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe PID 2972 wrote to memory of 3552 2972 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe PID 2972 wrote to memory of 3552 2972 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe PID 2972 wrote to memory of 3552 2972 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe PID 2972 wrote to memory of 3552 2972 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe PID 2972 wrote to memory of 3552 2972 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe -
outlook_office_path 1 IoCs
Processes:
943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe -
outlook_win_path 1 IoCs
Processes:
943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe"C:\Users\Admin\AppData\Local\Temp\943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe"C:\Users\Admin\AppData\Local\Temp\943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\943089ba13faf44a75c9624e2b68af1f561d5567bb4ba7cf4a2596b129da6a2b.exe.logFilesize
1KB
MD512557ab909651a6f99d3503d614d3562
SHA1b86745768059a514bea3a438e1e96086af463246
SHA2569589c869703e95d40d5870c60f66d8460f7914e9fe8dd579533c84148112babd
SHA51210cdb2fa7cf054af937b4aeddfe16fe755d6b09db5a51f7052adbf472b4b435e16c141f3712762f3b67f990c3efcfa47659576988e321214c747d6cd98e75521
-
memory/2972-118-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-119-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-120-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-121-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-122-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-123-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-124-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-125-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-126-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-127-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-128-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-129-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-130-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-131-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-132-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-133-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-134-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-135-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-136-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-137-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-138-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-139-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-140-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-141-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-142-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-143-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-144-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-145-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-146-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-147-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-148-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-149-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-150-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-151-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-152-0x0000000000680000-0x0000000000764000-memory.dmpFilesize
912KB
-
memory/2972-153-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-154-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-155-0x0000000005560000-0x0000000005A5E000-memory.dmpFilesize
5.0MB
-
memory/2972-156-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-157-0x0000000004F90000-0x0000000005022000-memory.dmpFilesize
584KB
-
memory/2972-158-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-159-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-160-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-161-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-162-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-163-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-164-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-165-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-166-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-167-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-168-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-169-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-170-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-171-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-172-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-173-0x0000000005030000-0x000000000503A000-memory.dmpFilesize
40KB
-
memory/2972-174-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-175-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-176-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-177-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-178-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-179-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-180-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-181-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-182-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-183-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-184-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-185-0x00000000085A0000-0x00000000085BC000-memory.dmpFilesize
112KB
-
memory/2972-186-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-188-0x0000000008860000-0x000000000886C000-memory.dmpFilesize
48KB
-
memory/2972-189-0x0000000008A40000-0x0000000008AD4000-memory.dmpFilesize
592KB
-
memory/2972-190-0x0000000008BA0000-0x0000000008C3C000-memory.dmpFilesize
624KB
-
memory/2972-191-0x0000000008C40000-0x0000000008CA6000-memory.dmpFilesize
408KB
-
memory/2972-192-0x0000000008B20000-0x0000000008B5A000-memory.dmpFilesize
232KB
-
memory/3552-194-0x0000000000435BCE-mapping.dmp
-
memory/3552-229-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3552-255-0x00000000059D0000-0x00000000059E8000-memory.dmpFilesize
96KB