Analysis

  • max time kernel
    79s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    25-11-2022 10:08

General

  • Target

    56a6d776412d00655381e2f1df4c53837c58ffb933bb5c896b4375fc97c3ae33.exe

  • Size

    821KB

  • MD5

    d35db88b2c20127d768d5258184ff3fc

  • SHA1

    4fc478d20bea3aac8b8bdab2a2fbbb6c8cee04ed

  • SHA256

    56a6d776412d00655381e2f1df4c53837c58ffb933bb5c896b4375fc97c3ae33

  • SHA512

    c232696dd0e7dd8d671de84c0f6115ca9536ea287327a928c52441c3fc5bafd18e7ae0c4bf673f0680572c625dbc2be73de02c129eae3e6cb06c3c11851dad88

  • SSDEEP

    12288:WG2qjXUb9tm//NXYQkCIgWB3FgE7WZi9709qtykVdsIC3+zCfYbumbfm8Ot5ui0D:rFQb9QZWJzcY67fbn/dY+uYzTo5

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ugoblaq007

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 6 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56a6d776412d00655381e2f1df4c53837c58ffb933bb5c896b4375fc97c3ae33.exe
    "C:\Users\Admin\AppData\Local\Temp\56a6d776412d00655381e2f1df4c53837c58ffb933bb5c896b4375fc97c3ae33.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:340
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QnWDZQozqDUEb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA5F1.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1240
    • C:\Users\Admin\AppData\Local\Temp\56a6d776412d00655381e2f1df4c53837c58ffb933bb5c896b4375fc97c3ae33.exe
      "{path}"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:1628

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpA5F1.tmp

    Filesize

    1KB

    MD5

    9d2ba87b2ad8f69bc80c4d19bc24f582

    SHA1

    e8d18c42b7769d59b488bfd9614a888f5407d954

    SHA256

    4dadeb09474f5c5a0eb7e94f6326093bff5305e33a59d26b14fa4a11f62a692b

    SHA512

    83fc7b071c1d8c27a81e112edc0211f0d9ad45cf11137d6b28f7178e80f685a3074326051227f2f448c280fec04e5a41579acc97a9876f696be9806a45ca9d67

  • memory/340-54-0x0000000001320000-0x00000000013F6000-memory.dmp

    Filesize

    856KB

  • memory/340-55-0x0000000075771000-0x0000000075773000-memory.dmp

    Filesize

    8KB

  • memory/340-56-0x00000000005C0000-0x00000000005CA000-memory.dmp

    Filesize

    40KB

  • memory/340-57-0x0000000005D00000-0x0000000005D94000-memory.dmp

    Filesize

    592KB

  • memory/1240-58-0x0000000000000000-mapping.dmp

  • memory/1628-60-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1628-61-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1628-63-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1628-64-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1628-65-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1628-66-0x000000000044A78E-mapping.dmp

  • memory/1628-68-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1628-70-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB