Analysis
-
max time kernel
61s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2022 11:27
Static task
static1
Behavioral task
behavioral1
Sample
December Order.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
December Order.exe
Resource
win10v2004-20220901-en
General
-
Target
December Order.exe
-
Size
969KB
-
MD5
3c8406ac154bba363837d323a2a5ccee
-
SHA1
a73f82eeef1422bf012ef7af853411a60bccb1e4
-
SHA256
94ebccd8a71740cab38549bb879d7c1a393c59e8b481e2e7bd37348e9724f39a
-
SHA512
60308e7bc4e862499b77c30c3bc6099c3336c78ed27c157bf2b1ca3a83ca705a6063d5cf8e4c987c2703401cf8cb8956a119ecf1c17900235f838a73c7b90f58
-
SSDEEP
12288:s9Gq7wTia38kfS/AzsEEY4rJ1j5DCwOGUBeFs9l76sI3Da+lLi93c/cfDSWf:swqETiwAAgEEY4dvDJb6+lLi9cKDSWf
Malware Config
Extracted
Protocol: smtp- Host:
host39.registrar-servers.com - Port:
587 - Username:
[email protected] - Password:
MI{ml&po^Oii 123
Extracted
agenttesla
Protocol: smtp- Host:
host39.registrar-servers.com - Port:
587 - Username:
[email protected] - Password:
MI{ml&po^Oii 123
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
December Order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 December Order.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 December Order.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 December Order.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
December Order.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WdFVsOe = "C:\\Users\\Admin\\AppData\\Roaming\\WdFVsOe\\WdFVsOe.exe" December Order.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
December Order.exedescription pid process target process PID 2012 set thread context of 2224 2012 December Order.exe December Order.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
December Order.exepid process 2224 December Order.exe 2224 December Order.exe 2224 December Order.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
December Order.exedescription pid process Token: SeDebugPrivilege 2224 December Order.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
December Order.exedescription pid process target process PID 2012 wrote to memory of 2224 2012 December Order.exe December Order.exe PID 2012 wrote to memory of 2224 2012 December Order.exe December Order.exe PID 2012 wrote to memory of 2224 2012 December Order.exe December Order.exe PID 2012 wrote to memory of 2224 2012 December Order.exe December Order.exe PID 2012 wrote to memory of 2224 2012 December Order.exe December Order.exe PID 2012 wrote to memory of 2224 2012 December Order.exe December Order.exe PID 2012 wrote to memory of 2224 2012 December Order.exe December Order.exe PID 2012 wrote to memory of 2224 2012 December Order.exe December Order.exe -
outlook_office_path 1 IoCs
Processes:
December Order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 December Order.exe -
outlook_win_path 1 IoCs
Processes:
December Order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 December Order.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\December Order.exe"C:\Users\Admin\AppData\Local\Temp\December Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\December Order.exe"C:\Users\Admin\AppData\Local\Temp\December Order.exe"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2012-132-0x0000000000DB0000-0x0000000000EA8000-memory.dmpFilesize
992KB
-
memory/2012-133-0x0000000005DB0000-0x0000000006354000-memory.dmpFilesize
5.6MB
-
memory/2012-134-0x00000000058A0000-0x0000000005932000-memory.dmpFilesize
584KB
-
memory/2012-135-0x0000000005860000-0x000000000586A000-memory.dmpFilesize
40KB
-
memory/2012-136-0x00000000092A0000-0x000000000933C000-memory.dmpFilesize
624KB
-
memory/2224-137-0x0000000000000000-mapping.dmp
-
memory/2224-138-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2224-139-0x0000000005D40000-0x0000000005DA6000-memory.dmpFilesize
408KB
-
memory/2224-140-0x00000000061F0000-0x0000000006240000-memory.dmpFilesize
320KB