Analysis
-
max time kernel
196s -
max time network
218s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 13:23
Static task
static1
Behavioral task
behavioral1
Sample
URGENT REQUIREMENT.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
URGENT REQUIREMENT.exe
Resource
win10v2004-20221111-en
General
-
Target
URGENT REQUIREMENT.exe
-
Size
478KB
-
MD5
9d97e728e9d190e4be44cd0e2b6af94e
-
SHA1
f14cd79d94d5edf2f9b006689f468baa25e971c4
-
SHA256
81278e61b365975c3ba6eb47c4734c4831e2488dfd3357cf8d0d018b4a57123f
-
SHA512
c6765a669724cb5310501d855a87c194f3df9494dee1a71e08519a197d36f6ba698064e136ef290c2e8c2dabe9c65ee0cb42a5d2ae047e8c75c30d40d9a946a1
-
SSDEEP
12288:mT9ZvF2KWHeaAabCMWh+mgXlwCE9Ra6Mu2C/E:+9ZvF2zAabjJAW6Mu3/
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.svcnc.com - Port:
587 - Username:
krupakar@svcnc.com - Password:
Krupashine@6791 - Email To:
decenmomodou20@gmail.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
CasPol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
URGENT REQUIREMENT.exedescription pid process target process PID 4904 set thread context of 4320 4904 URGENT REQUIREMENT.exe CasPol.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
CasPol.exepid process 4320 CasPol.exe 4320 CasPol.exe 4320 CasPol.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
CasPol.exedescription pid process Token: SeDebugPrivilege 4320 CasPol.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
URGENT REQUIREMENT.exedescription pid process target process PID 4904 wrote to memory of 4320 4904 URGENT REQUIREMENT.exe CasPol.exe PID 4904 wrote to memory of 4320 4904 URGENT REQUIREMENT.exe CasPol.exe PID 4904 wrote to memory of 4320 4904 URGENT REQUIREMENT.exe CasPol.exe PID 4904 wrote to memory of 4320 4904 URGENT REQUIREMENT.exe CasPol.exe PID 4904 wrote to memory of 4320 4904 URGENT REQUIREMENT.exe CasPol.exe PID 4904 wrote to memory of 4320 4904 URGENT REQUIREMENT.exe CasPol.exe PID 4904 wrote to memory of 4320 4904 URGENT REQUIREMENT.exe CasPol.exe PID 4904 wrote to memory of 4320 4904 URGENT REQUIREMENT.exe CasPol.exe -
outlook_office_path 1 IoCs
Processes:
CasPol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe -
outlook_win_path 1 IoCs
Processes:
CasPol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 CasPol.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\URGENT REQUIREMENT.exe"C:\Users\Admin\AppData\Local\Temp\URGENT REQUIREMENT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4320-135-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/4320-136-0x0000000000437B2E-mapping.dmp
-
memory/4320-138-0x0000000005D60000-0x0000000006304000-memory.dmpFilesize
5.6MB
-
memory/4320-139-0x0000000005850000-0x00000000058EC000-memory.dmpFilesize
624KB
-
memory/4320-140-0x0000000006650000-0x00000000066B6000-memory.dmpFilesize
408KB
-
memory/4320-141-0x0000000006A50000-0x0000000006AA0000-memory.dmpFilesize
320KB
-
memory/4904-132-0x0000018C58DF0000-0x0000018C58E6C000-memory.dmpFilesize
496KB
-
memory/4904-133-0x00007FF99E550000-0x00007FF99F011000-memory.dmpFilesize
10.8MB
-
memory/4904-134-0x00007FF99E550000-0x00007FF99F011000-memory.dmpFilesize
10.8MB
-
memory/4904-137-0x00007FF99E550000-0x00007FF99F011000-memory.dmpFilesize
10.8MB