Analysis
-
max time kernel
112s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 08:03
Static task
static1
Behavioral task
behavioral1
Sample
d37df64a441aae0025e509e08dace830.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d37df64a441aae0025e509e08dace830.exe
Resource
win10v2004-20220901-en
General
-
Target
d37df64a441aae0025e509e08dace830.exe
-
Size
670KB
-
MD5
d37df64a441aae0025e509e08dace830
-
SHA1
e466c3fd79844bde116aa7b372bde23316e9acd8
-
SHA256
5e63926b7ce5fb0d4bc1363397c655d0c3b29114497308db183b124b048c033f
-
SHA512
4ce48986a74c1e099e6177b865d41e950c2c073306c0464f7b060a696d217826081b1c4af355594694304dcb5eaffedfd7a6ff74defb9fd119bca5ace06039a7
-
SSDEEP
12288:iPuYd+V6b1momPZef5XmeFMGIhZNKfNo4uQYWOgBlpkLnLR0iFRnbGOOPuYd+V6b:iPuYd+V6bIomxi5XPyLKfN6QYPgj2zL
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5466358579:AAFHSCLt1chyZSTsCVrxZSdLSPQ_50Hs-ww/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d37df64a441aae0025e509e08dace830.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation d37df64a441aae0025e509e08dace830.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
d37df64a441aae0025e509e08dace830.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d37df64a441aae0025e509e08dace830.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d37df64a441aae0025e509e08dace830.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d37df64a441aae0025e509e08dace830.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d37df64a441aae0025e509e08dace830.exedescription pid process target process PID 796 set thread context of 3696 796 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
d37df64a441aae0025e509e08dace830.exepowershell.exed37df64a441aae0025e509e08dace830.exepid process 796 d37df64a441aae0025e509e08dace830.exe 796 d37df64a441aae0025e509e08dace830.exe 720 powershell.exe 3696 d37df64a441aae0025e509e08dace830.exe 3696 d37df64a441aae0025e509e08dace830.exe 720 powershell.exe 3696 d37df64a441aae0025e509e08dace830.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
d37df64a441aae0025e509e08dace830.exepowershell.exed37df64a441aae0025e509e08dace830.exedescription pid process Token: SeDebugPrivilege 796 d37df64a441aae0025e509e08dace830.exe Token: SeDebugPrivilege 720 powershell.exe Token: SeDebugPrivilege 3696 d37df64a441aae0025e509e08dace830.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
d37df64a441aae0025e509e08dace830.exepid process 3696 d37df64a441aae0025e509e08dace830.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
d37df64a441aae0025e509e08dace830.exedescription pid process target process PID 796 wrote to memory of 720 796 d37df64a441aae0025e509e08dace830.exe powershell.exe PID 796 wrote to memory of 720 796 d37df64a441aae0025e509e08dace830.exe powershell.exe PID 796 wrote to memory of 720 796 d37df64a441aae0025e509e08dace830.exe powershell.exe PID 796 wrote to memory of 824 796 d37df64a441aae0025e509e08dace830.exe schtasks.exe PID 796 wrote to memory of 824 796 d37df64a441aae0025e509e08dace830.exe schtasks.exe PID 796 wrote to memory of 824 796 d37df64a441aae0025e509e08dace830.exe schtasks.exe PID 796 wrote to memory of 3696 796 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe PID 796 wrote to memory of 3696 796 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe PID 796 wrote to memory of 3696 796 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe PID 796 wrote to memory of 3696 796 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe PID 796 wrote to memory of 3696 796 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe PID 796 wrote to memory of 3696 796 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe PID 796 wrote to memory of 3696 796 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe PID 796 wrote to memory of 3696 796 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe -
outlook_office_path 1 IoCs
Processes:
d37df64a441aae0025e509e08dace830.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d37df64a441aae0025e509e08dace830.exe -
outlook_win_path 1 IoCs
Processes:
d37df64a441aae0025e509e08dace830.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 d37df64a441aae0025e509e08dace830.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d37df64a441aae0025e509e08dace830.exe"C:\Users\Admin\AppData\Local\Temp\d37df64a441aae0025e509e08dace830.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TkIrKeUGaTLcN.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TkIrKeUGaTLcN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5F27.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\d37df64a441aae0025e509e08dace830.exe"C:\Users\Admin\AppData\Local\Temp\d37df64a441aae0025e509e08dace830.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d37df64a441aae0025e509e08dace830.exe.logFilesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
C:\Users\Admin\AppData\Local\Temp\tmp5F27.tmpFilesize
1KB
MD58b6362a225ee76921dccc16bf833ecbd
SHA15b9d54688e087f5c291faf0683c8119676fcaa09
SHA256426be31a2a65490a8f47e71ef33e01d0da60319cae7c2cfe06b2e676736f5377
SHA51298b05a2df5c0c6edc2456161be2fd1be98fc9113d59bb1501c73b71fe1bb71b1a5aeb20203887ed2f26875381d14a1b2024a2470b63d79251e5d30dbe7c76ec5
-
memory/720-146-0x00000000060B0000-0x0000000006116000-memory.dmpFilesize
408KB
-
memory/720-153-0x0000000007B60000-0x0000000007B7A000-memory.dmpFilesize
104KB
-
memory/720-147-0x0000000006190000-0x00000000061F6000-memory.dmpFilesize
408KB
-
memory/720-148-0x0000000006860000-0x000000000687E000-memory.dmpFilesize
120KB
-
memory/720-158-0x0000000007EA0000-0x0000000007EBA000-memory.dmpFilesize
104KB
-
memory/720-139-0x0000000002EB0000-0x0000000002EE6000-memory.dmpFilesize
216KB
-
memory/720-157-0x0000000007D90000-0x0000000007D9E000-memory.dmpFilesize
56KB
-
memory/720-142-0x0000000005A80000-0x00000000060A8000-memory.dmpFilesize
6.2MB
-
memory/720-155-0x0000000007DE0000-0x0000000007E76000-memory.dmpFilesize
600KB
-
memory/720-154-0x0000000007BE0000-0x0000000007BEA000-memory.dmpFilesize
40KB
-
memory/720-152-0x00000000081B0000-0x000000000882A000-memory.dmpFilesize
6.5MB
-
memory/720-145-0x0000000005830000-0x0000000005852000-memory.dmpFilesize
136KB
-
memory/720-159-0x0000000007E80000-0x0000000007E88000-memory.dmpFilesize
32KB
-
memory/720-151-0x0000000006E10000-0x0000000006E2E000-memory.dmpFilesize
120KB
-
memory/720-137-0x0000000000000000-mapping.dmp
-
memory/720-149-0x0000000006E30000-0x0000000006E62000-memory.dmpFilesize
200KB
-
memory/720-150-0x00000000708B0000-0x00000000708FC000-memory.dmpFilesize
304KB
-
memory/796-136-0x00000000069D0000-0x0000000006A6C000-memory.dmpFilesize
624KB
-
memory/796-133-0x0000000005EB0000-0x0000000006454000-memory.dmpFilesize
5.6MB
-
memory/796-135-0x0000000005920000-0x000000000592A000-memory.dmpFilesize
40KB
-
memory/796-134-0x00000000059A0000-0x0000000005A32000-memory.dmpFilesize
584KB
-
memory/796-132-0x0000000000FD0000-0x000000000107E000-memory.dmpFilesize
696KB
-
memory/824-138-0x0000000000000000-mapping.dmp
-
memory/3696-141-0x0000000000000000-mapping.dmp
-
memory/3696-143-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3696-156-0x0000000006B90000-0x0000000006BE0000-memory.dmpFilesize
320KB