Analysis
-
max time kernel
48s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
26-11-2022 10:12
Behavioral task
behavioral1
Sample
d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exe
Resource
win10-20220901-en
General
-
Target
d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exe
-
Size
209KB
-
MD5
3689863670bdbe4cbebb8a8f547f78b5
-
SHA1
89ca4ac602d587d8c9b6af9cd2fa7a1059c954ff
-
SHA256
d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6
-
SHA512
1d3ab0a534e5fc64019e97657ffc86b35aeda3efeef301421bad4c867103a9cee13db5921d3f3c97f8ef945e0a450a210bbeb224a8fbc7ba430b35328434bae8
-
SSDEEP
3072:4qTIj2We5cfsyYOQ1Z3M0ZH52NSsYUTY82eRnFih+rSs5ThVlmx2XGYmcCXfyFNz:RTJcZ4Z3M0ZI4UTY82eRluwTLwHUHta
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.leonardfood.com - Port:
587 - Username:
[email protected] - Password:
K@rimi95 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exe Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exe Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exepid process 1980 d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exe 1980 d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exedescription pid process Token: SeDebugPrivilege 1980 d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exepid process 1980 d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exe -
outlook_office_path 1 IoCs
Processes:
d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exe -
outlook_win_path 1 IoCs
Processes:
d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exe"C:\Users\Admin\AppData\Local\Temp\d3eeb44651622553b13bca65755ab7714b54b88f9653c1d08ea2c8ea14048aa6.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1980
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1980-120-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-121-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-122-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-123-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-124-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-125-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-126-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-127-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-128-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-129-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-130-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-131-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-132-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-133-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-134-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-135-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-136-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-137-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-139-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-138-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-141-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-142-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-143-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-144-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-140-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-145-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-146-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-147-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-148-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-149-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-150-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-151-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-152-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-153-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-154-0x0000000000800000-0x000000000083A000-memory.dmpFilesize
232KB
-
memory/1980-155-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-156-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-157-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-158-0x0000000005630000-0x0000000005B2E000-memory.dmpFilesize
5.0MB
-
memory/1980-159-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-160-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-161-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-162-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-163-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-164-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-165-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-166-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-167-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-168-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-169-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-170-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-171-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-172-0x0000000005130000-0x00000000051CC000-memory.dmpFilesize
624KB
-
memory/1980-173-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-174-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-175-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-176-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-177-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-178-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-179-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-180-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-181-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-182-0x0000000005290000-0x00000000052A8000-memory.dmpFilesize
96KB
-
memory/1980-183-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-184-0x0000000005C90000-0x0000000005CF6000-memory.dmpFilesize
408KB
-
memory/1980-185-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-186-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-187-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-188-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-199-0x0000000006570000-0x0000000006602000-memory.dmpFilesize
584KB
-
memory/1980-201-0x0000000006510000-0x000000000651A000-memory.dmpFilesize
40KB