Analysis
-
max time kernel
104s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 09:44
Static task
static1
Behavioral task
behavioral1
Sample
UPDATED SOA (2).exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
UPDATED SOA (2).exe
Resource
win10v2004-20220901-en
General
-
Target
UPDATED SOA (2).exe
-
Size
482KB
-
MD5
74413d410ade63316e64fd13643c5472
-
SHA1
e799abf182ebbda566506ab24d1c3291d2b5045c
-
SHA256
a8db61754cfe3eb3cde12a63eadb0631b3437bbbe05bb9c1bbf7d3f4af31a56d
-
SHA512
46278aecc22bfcb435f3463f8fccef1e9a11ee029f80f071f313033cd5c8e0f2939caba6a554797c217b7afc0f11f96e5dd6a29a72706696d848c976c31fcbcb
-
SSDEEP
12288:3gJKPIrufvlcmVUZ7DkosENw2xyVbzUh/e237lEXO52I4mYF+:3sKPmql7VUZ7PsECxXi2s4
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.svcnc.com - Port:
587 - Username:
[email protected] - Password:
Krupashine@6791 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
CasPol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe Key opened \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe Key opened \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
UPDATED SOA (2).exedescription pid process target process PID 1336 set thread context of 692 1336 UPDATED SOA (2).exe CasPol.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
CasPol.exepid process 692 CasPol.exe 692 CasPol.exe 692 CasPol.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
CasPol.exedescription pid process Token: SeDebugPrivilege 692 CasPol.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
UPDATED SOA (2).exedescription pid process target process PID 1336 wrote to memory of 692 1336 UPDATED SOA (2).exe CasPol.exe PID 1336 wrote to memory of 692 1336 UPDATED SOA (2).exe CasPol.exe PID 1336 wrote to memory of 692 1336 UPDATED SOA (2).exe CasPol.exe PID 1336 wrote to memory of 692 1336 UPDATED SOA (2).exe CasPol.exe PID 1336 wrote to memory of 692 1336 UPDATED SOA (2).exe CasPol.exe PID 1336 wrote to memory of 692 1336 UPDATED SOA (2).exe CasPol.exe PID 1336 wrote to memory of 692 1336 UPDATED SOA (2).exe CasPol.exe PID 1336 wrote to memory of 692 1336 UPDATED SOA (2).exe CasPol.exe PID 1336 wrote to memory of 692 1336 UPDATED SOA (2).exe CasPol.exe -
outlook_office_path 1 IoCs
Processes:
CasPol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe -
outlook_win_path 1 IoCs
Processes:
CasPol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\UPDATED SOA (2).exe"C:\Users\Admin\AppData\Local\Temp\UPDATED SOA (2).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/692-56-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/692-57-0x0000000000437B2E-mapping.dmp
-
memory/692-59-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/692-61-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/692-62-0x0000000075F01000-0x0000000075F03000-memory.dmpFilesize
8KB
-
memory/1336-54-0x00000000008A0000-0x000000000091C000-memory.dmpFilesize
496KB
-
memory/1336-55-0x00000000007E0000-0x000000000085A000-memory.dmpFilesize
488KB