Analysis
-
max time kernel
70s -
max time network
126s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
06-12-2022 08:23
Static task
static1
Behavioral task
behavioral1
Sample
591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe
Resource
win10-20220812-en
General
-
Target
591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe
-
Size
837KB
-
MD5
5b0b65b9ad793f8d127a90f7f31e8d39
-
SHA1
6a7ede3e8f6064ec1a0b0ddaf97887d8d3567fe3
-
SHA256
591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce
-
SHA512
ec31b35402802af0ec85035071ddd66921d02a98d7b385cc3e8a727c1b6a1d4aa948d02cb6accb54ef346b166b5ee7fea855ef35f8017d449d89c96939f7e4df
-
SSDEEP
12288:Fc3fYBSWcVlcLOaYKzqCig4fVTMHPKX3QPKvjma/gKZ/nXt7virmWhlGLaQYI:egBiqOaZzxigO5MCQPKr
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1048308947817353288/5ypgS4XmSt1xW_MYhzjePp8jxnOIkdnEO0OTccrP0m7sB3ynEyezAUtrX-js6a4kTsJ8
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe Key opened \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe Key opened \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 api.ipify.org 15 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exedescription pid process target process PID 2584 set thread context of 3504 2584 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exepid process 3504 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe 3504 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exedescription pid process Token: SeDebugPrivilege 3504 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exepid process 3504 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exedescription pid process target process PID 2584 wrote to memory of 3504 2584 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe PID 2584 wrote to memory of 3504 2584 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe PID 2584 wrote to memory of 3504 2584 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe PID 2584 wrote to memory of 3504 2584 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe PID 2584 wrote to memory of 3504 2584 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe PID 2584 wrote to memory of 3504 2584 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe PID 2584 wrote to memory of 3504 2584 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe PID 2584 wrote to memory of 3504 2584 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe -
outlook_office_path 1 IoCs
Processes:
591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe -
outlook_win_path 1 IoCs
Processes:
591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe"C:\Users\Admin\AppData\Local\Temp\591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe"C:\Users\Admin\AppData\Local\Temp\591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\591e486f7e4431a0be2cd22abd2c4ad9c97f4eeaf8a387ef816fa32e15b267ce.exe.logFilesize
1KB
MD50c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
memory/2584-117-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-118-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-119-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-120-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-121-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-122-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-123-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-124-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-125-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-126-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-127-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-128-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-129-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-130-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-131-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-132-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-133-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-134-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-135-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-136-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-137-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-138-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-139-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-140-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-141-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-142-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-143-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-144-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-145-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-146-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-147-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-148-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-149-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-150-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-151-0x00000000007D0000-0x00000000008A8000-memory.dmpFilesize
864KB
-
memory/2584-152-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-153-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-154-0x00000000057B0000-0x0000000005CAE000-memory.dmpFilesize
5.0MB
-
memory/2584-155-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-156-0x0000000005120000-0x00000000051B2000-memory.dmpFilesize
584KB
-
memory/2584-157-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-158-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-159-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-160-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-161-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-162-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-163-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-164-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-165-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-166-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-167-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-168-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-169-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-170-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-171-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-172-0x0000000005220000-0x000000000522A000-memory.dmpFilesize
40KB
-
memory/2584-173-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-174-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-175-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-176-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-177-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-178-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-179-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-180-0x00000000052F0000-0x0000000005306000-memory.dmpFilesize
88KB
-
memory/2584-181-0x0000000005780000-0x000000000578E000-memory.dmpFilesize
56KB
-
memory/2584-182-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-183-0x00000000078E0000-0x000000000795E000-memory.dmpFilesize
504KB
-
memory/2584-184-0x0000000007A10000-0x0000000007AAC000-memory.dmpFilesize
624KB
-
memory/2584-185-0x00000000079D0000-0x0000000007A14000-memory.dmpFilesize
272KB
-
memory/3504-186-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3504-187-0x000000000043205E-mapping.dmp
-
memory/3504-188-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3504-189-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3504-190-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3504-247-0x0000000005A50000-0x0000000005A68000-memory.dmpFilesize
96KB
-
memory/3504-249-0x0000000006310000-0x0000000006376000-memory.dmpFilesize
408KB