Analysis
-
max time kernel
216s -
max time network
332s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 09:44
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v2004-20220901-en
General
-
Target
Quotation.exe
-
Size
482KB
-
MD5
74413d410ade63316e64fd13643c5472
-
SHA1
e799abf182ebbda566506ab24d1c3291d2b5045c
-
SHA256
a8db61754cfe3eb3cde12a63eadb0631b3437bbbe05bb9c1bbf7d3f4af31a56d
-
SHA512
46278aecc22bfcb435f3463f8fccef1e9a11ee029f80f071f313033cd5c8e0f2939caba6a554797c217b7afc0f11f96e5dd6a29a72706696d848c976c31fcbcb
-
SSDEEP
12288:3gJKPIrufvlcmVUZ7DkosENw2xyVbzUh/e237lEXO52I4mYF+:3sKPmql7VUZ7PsECxXi2s4
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.svcnc.com - Port:
587 - Username:
[email protected] - Password:
Krupashine@6791 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
CasPol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Quotation.exedescription pid process target process PID 1520 set thread context of 1732 1520 Quotation.exe CasPol.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
CasPol.exepid process 1732 CasPol.exe 1732 CasPol.exe 1732 CasPol.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
CasPol.exedescription pid process Token: SeDebugPrivilege 1732 CasPol.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Quotation.exedescription pid process target process PID 1520 wrote to memory of 1732 1520 Quotation.exe CasPol.exe PID 1520 wrote to memory of 1732 1520 Quotation.exe CasPol.exe PID 1520 wrote to memory of 1732 1520 Quotation.exe CasPol.exe PID 1520 wrote to memory of 1732 1520 Quotation.exe CasPol.exe PID 1520 wrote to memory of 1732 1520 Quotation.exe CasPol.exe PID 1520 wrote to memory of 1732 1520 Quotation.exe CasPol.exe PID 1520 wrote to memory of 1732 1520 Quotation.exe CasPol.exe PID 1520 wrote to memory of 1732 1520 Quotation.exe CasPol.exe PID 1520 wrote to memory of 1732 1520 Quotation.exe CasPol.exe -
outlook_office_path 1 IoCs
Processes:
CasPol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe -
outlook_win_path 1 IoCs
Processes:
CasPol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1732
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1520-54-0x0000000000EB0000-0x0000000000F2C000-memory.dmpFilesize
496KB
-
memory/1520-55-0x00000000005C0000-0x000000000063A000-memory.dmpFilesize
488KB
-
memory/1732-56-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1732-57-0x0000000000437B2E-mapping.dmp
-
memory/1732-59-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1732-61-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1732-62-0x0000000074DA1000-0x0000000074DA3000-memory.dmpFilesize
8KB