Analysis

  • max time kernel
    70s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2022 09:40

General

  • Target

    BL copy.exe

  • Size

    478KB

  • MD5

    c0ba88e93c37a5381ed30ebe13e3230d

  • SHA1

    dbb6385a5acc6993e234d533b75bfc888dab8649

  • SHA256

    4d32ec11bf2963e4a505853ea46c4b15b73ad0b435fd3f279d034480335901a9

  • SHA512

    0c6160803d16677c7b00821dc612aea82ed6424272160d9117076227b762609bab2a22b18b1edc88c91579ef04f88877601176e70420a2ecdda63990fc1f496e

  • SSDEEP

    6144:bEa0biTgOrovwH/BdHZONl0E5aHKVRjT8i1M1IeFZSjyhlk7NQr1LsPD4RtR0:YfyovWHONluHKVRjAiCuyh86BgD4l0

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5663632223:AAG5KHZDs7KWoaqTYx3lSyFlOdfD9vGegQo/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BL copy.exe
    "C:\Users\Admin\AppData\Local\Temp\BL copy.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:876
    • C:\Users\Admin\AppData\Local\Temp\aiikyaiziv.exe
      "C:\Users\Admin\AppData\Local\Temp\aiikyaiziv.exe" C:\Users\Admin\AppData\Local\Temp\iexhn.w
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1492
      • C:\Users\Admin\AppData\Local\Temp\aiikyaiziv.exe
        "C:\Users\Admin\AppData\Local\Temp\aiikyaiziv.exe" C:\Users\Admin\AppData\Local\Temp\iexhn.w
        3⤵
        • Executes dropped EXE
        PID:1784
      • C:\Users\Admin\AppData\Local\Temp\aiikyaiziv.exe
        "C:\Users\Admin\AppData\Local\Temp\aiikyaiziv.exe" C:\Users\Admin\AppData\Local\Temp\iexhn.w
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:1376

Network

  • flag-unknown
    DNS
    api.ipify.org
    aiikyaiziv.exe
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN CNAME
    api.ipify.org.herokudns.com
    api.ipify.org.herokudns.com
    IN A
    3.232.242.170
    api.ipify.org.herokudns.com
    IN A
    3.220.57.224
    api.ipify.org.herokudns.com
    IN A
    54.91.59.199
    api.ipify.org.herokudns.com
    IN A
    52.20.78.240
  • 3.232.242.170:443
    api.ipify.org
    tls
    aiikyaiziv.exe
    385 B
    219 B
    5
    5
  • 8.8.8.8:53
    api.ipify.org
    dns
    aiikyaiziv.exe
    59 B
    164 B
    1
    1

    DNS Request

    api.ipify.org

    DNS Response

    3.232.242.170
    3.220.57.224
    54.91.59.199
    52.20.78.240

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\aiikyaiziv.exe

    Filesize

    7KB

    MD5

    27d66b1f9d5a06f086d46350d0e27fe9

    SHA1

    c42051eccb3ffb7d12a18136a8f3aa702e038417

    SHA256

    1d3019ff5f6a2d28f7d876fdbbc8acc1215368f3f562fa988f6bacba4f6b23d7

    SHA512

    be7ded13a8517ad800ad3fbe078dea8040e1b28a706eb58c264deaf77fb4957228983069c626aa9a63a1d62b967e2e131148d798d9a94b64eccc6264931ce8a6

  • C:\Users\Admin\AppData\Local\Temp\aiikyaiziv.exe

    Filesize

    7KB

    MD5

    27d66b1f9d5a06f086d46350d0e27fe9

    SHA1

    c42051eccb3ffb7d12a18136a8f3aa702e038417

    SHA256

    1d3019ff5f6a2d28f7d876fdbbc8acc1215368f3f562fa988f6bacba4f6b23d7

    SHA512

    be7ded13a8517ad800ad3fbe078dea8040e1b28a706eb58c264deaf77fb4957228983069c626aa9a63a1d62b967e2e131148d798d9a94b64eccc6264931ce8a6

  • C:\Users\Admin\AppData\Local\Temp\aiikyaiziv.exe

    Filesize

    7KB

    MD5

    27d66b1f9d5a06f086d46350d0e27fe9

    SHA1

    c42051eccb3ffb7d12a18136a8f3aa702e038417

    SHA256

    1d3019ff5f6a2d28f7d876fdbbc8acc1215368f3f562fa988f6bacba4f6b23d7

    SHA512

    be7ded13a8517ad800ad3fbe078dea8040e1b28a706eb58c264deaf77fb4957228983069c626aa9a63a1d62b967e2e131148d798d9a94b64eccc6264931ce8a6

  • C:\Users\Admin\AppData\Local\Temp\aiikyaiziv.exe

    Filesize

    7KB

    MD5

    27d66b1f9d5a06f086d46350d0e27fe9

    SHA1

    c42051eccb3ffb7d12a18136a8f3aa702e038417

    SHA256

    1d3019ff5f6a2d28f7d876fdbbc8acc1215368f3f562fa988f6bacba4f6b23d7

    SHA512

    be7ded13a8517ad800ad3fbe078dea8040e1b28a706eb58c264deaf77fb4957228983069c626aa9a63a1d62b967e2e131148d798d9a94b64eccc6264931ce8a6

  • C:\Users\Admin\AppData\Local\Temp\cdnjja.z

    Filesize

    296KB

    MD5

    f2287e43eba99766fa513804d8e14539

    SHA1

    53a14c5f1e5ffe5d51ee36f7e2cfbdd953ce9599

    SHA256

    f4a92a2684b2e3128c83ead312f99f6f674705eb8e7390343d989cfb58838913

    SHA512

    c8852a775d292467388eafc3aedbfdfebabf2dc15139df42b2c16bc057de18d4adbe93d43ab88c24a21c16ac88b55b64dcff39e7ced26cf1bf287a5492764402

  • C:\Users\Admin\AppData\Local\Temp\iexhn.w

    Filesize

    7KB

    MD5

    7e3cc5383386f3a981bda79f437a9bc1

    SHA1

    8df7941ad5fd04aaa657220fac18026250036f76

    SHA256

    7c6ec6ef27019dc456e0e2714730374d38319e681ba36cc633375de57b3ed110

    SHA512

    3a3b3714daaab812059bcb937730604bc437fd708101f3bee6fc682b14623df01b3112799804e3ede41747de645d529832ccb82ba99a4b6efe34390b3ecdc6ea

  • \Users\Admin\AppData\Local\Temp\aiikyaiziv.exe

    Filesize

    7KB

    MD5

    27d66b1f9d5a06f086d46350d0e27fe9

    SHA1

    c42051eccb3ffb7d12a18136a8f3aa702e038417

    SHA256

    1d3019ff5f6a2d28f7d876fdbbc8acc1215368f3f562fa988f6bacba4f6b23d7

    SHA512

    be7ded13a8517ad800ad3fbe078dea8040e1b28a706eb58c264deaf77fb4957228983069c626aa9a63a1d62b967e2e131148d798d9a94b64eccc6264931ce8a6

  • \Users\Admin\AppData\Local\Temp\aiikyaiziv.exe

    Filesize

    7KB

    MD5

    27d66b1f9d5a06f086d46350d0e27fe9

    SHA1

    c42051eccb3ffb7d12a18136a8f3aa702e038417

    SHA256

    1d3019ff5f6a2d28f7d876fdbbc8acc1215368f3f562fa988f6bacba4f6b23d7

    SHA512

    be7ded13a8517ad800ad3fbe078dea8040e1b28a706eb58c264deaf77fb4957228983069c626aa9a63a1d62b967e2e131148d798d9a94b64eccc6264931ce8a6

  • \Users\Admin\AppData\Local\Temp\aiikyaiziv.exe

    Filesize

    7KB

    MD5

    27d66b1f9d5a06f086d46350d0e27fe9

    SHA1

    c42051eccb3ffb7d12a18136a8f3aa702e038417

    SHA256

    1d3019ff5f6a2d28f7d876fdbbc8acc1215368f3f562fa988f6bacba4f6b23d7

    SHA512

    be7ded13a8517ad800ad3fbe078dea8040e1b28a706eb58c264deaf77fb4957228983069c626aa9a63a1d62b967e2e131148d798d9a94b64eccc6264931ce8a6

  • memory/876-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

    Filesize

    8KB

  • memory/1376-65-0x0000000000401896-mapping.dmp

  • memory/1376-68-0x00000000005E0000-0x000000000061C000-memory.dmp

    Filesize

    240KB

  • memory/1376-69-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1492-56-0x0000000000000000-mapping.dmp

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.