Analysis
-
max time kernel
151s -
max time network
192s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
07-12-2022 07:16
Static task
static1
Behavioral task
behavioral1
Sample
PO_4500003061 signed copy.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
PO_4500003061 signed copy.exe
Resource
win10v2004-20220901-en
General
-
Target
PO_4500003061 signed copy.exe
-
Size
880KB
-
MD5
9bd1c9256c64814f6c83e3a76f60c42c
-
SHA1
b7867985ca8a61d942e82a021e27b9dbea5c0b42
-
SHA256
59e009667dbb1344d0639b171763fe0d79b27e4419df4ee9829b7789197cc6e4
-
SHA512
ec602de86a0eaf3472a2bade71d66b05e3fb833a14392baae9bf699a46aebbd8c2892cea2ecca9ec8b79d3a68a6f86c43bf267888bc83607fecd40bbf24fa102
-
SSDEEP
24576:mvH2Mj6pEyFxCUVZHp24gBxIKH9zPlESv:mvWMu6yFVVxp24gBzRP+Sv
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.saudlunion.com - Port:
587 - Username:
[email protected] - Password:
QkOo#D#4
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
PO_4500003061 signed copy.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO_4500003061 signed copy.exe Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO_4500003061 signed copy.exe Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO_4500003061 signed copy.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO_4500003061 signed copy.exedescription pid process target process PID 892 set thread context of 1692 892 PO_4500003061 signed copy.exe PO_4500003061 signed copy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
PO_4500003061 signed copy.exePO_4500003061 signed copy.exepowershell.exepid process 892 PO_4500003061 signed copy.exe 892 PO_4500003061 signed copy.exe 892 PO_4500003061 signed copy.exe 892 PO_4500003061 signed copy.exe 892 PO_4500003061 signed copy.exe 892 PO_4500003061 signed copy.exe 892 PO_4500003061 signed copy.exe 892 PO_4500003061 signed copy.exe 892 PO_4500003061 signed copy.exe 1692 PO_4500003061 signed copy.exe 1692 PO_4500003061 signed copy.exe 572 powershell.exe 1692 PO_4500003061 signed copy.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO_4500003061 signed copy.exePO_4500003061 signed copy.exepowershell.exedescription pid process Token: SeDebugPrivilege 892 PO_4500003061 signed copy.exe Token: SeDebugPrivilege 1692 PO_4500003061 signed copy.exe Token: SeDebugPrivilege 572 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
PO_4500003061 signed copy.exedescription pid process target process PID 892 wrote to memory of 572 892 PO_4500003061 signed copy.exe powershell.exe PID 892 wrote to memory of 572 892 PO_4500003061 signed copy.exe powershell.exe PID 892 wrote to memory of 572 892 PO_4500003061 signed copy.exe powershell.exe PID 892 wrote to memory of 572 892 PO_4500003061 signed copy.exe powershell.exe PID 892 wrote to memory of 828 892 PO_4500003061 signed copy.exe schtasks.exe PID 892 wrote to memory of 828 892 PO_4500003061 signed copy.exe schtasks.exe PID 892 wrote to memory of 828 892 PO_4500003061 signed copy.exe schtasks.exe PID 892 wrote to memory of 828 892 PO_4500003061 signed copy.exe schtasks.exe PID 892 wrote to memory of 1692 892 PO_4500003061 signed copy.exe PO_4500003061 signed copy.exe PID 892 wrote to memory of 1692 892 PO_4500003061 signed copy.exe PO_4500003061 signed copy.exe PID 892 wrote to memory of 1692 892 PO_4500003061 signed copy.exe PO_4500003061 signed copy.exe PID 892 wrote to memory of 1692 892 PO_4500003061 signed copy.exe PO_4500003061 signed copy.exe PID 892 wrote to memory of 1692 892 PO_4500003061 signed copy.exe PO_4500003061 signed copy.exe PID 892 wrote to memory of 1692 892 PO_4500003061 signed copy.exe PO_4500003061 signed copy.exe PID 892 wrote to memory of 1692 892 PO_4500003061 signed copy.exe PO_4500003061 signed copy.exe PID 892 wrote to memory of 1692 892 PO_4500003061 signed copy.exe PO_4500003061 signed copy.exe PID 892 wrote to memory of 1692 892 PO_4500003061 signed copy.exe PO_4500003061 signed copy.exe -
outlook_office_path 1 IoCs
Processes:
PO_4500003061 signed copy.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO_4500003061 signed copy.exe -
outlook_win_path 1 IoCs
Processes:
PO_4500003061 signed copy.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO_4500003061 signed copy.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO_4500003061 signed copy.exe"C:\Users\Admin\AppData\Local\Temp\PO_4500003061 signed copy.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hCAyCw.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hCAyCw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp538D.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO_4500003061 signed copy.exe"C:\Users\Admin\AppData\Local\Temp\PO_4500003061 signed copy.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp538D.tmpFilesize
1KB
MD57b59fc9e685d9b21a4833c741af20bdc
SHA12c539046dc4f19c7216924c6199584a9120e7f0e
SHA256d5f7018b13010c8fe6bbbda708fddc23e909e5b32c7b593d140d74b14383b372
SHA5124f4bf7d696b3f9a8ce40c60ad560d50d08f17d4058cf7ff381646f1c69113c564f24c7fa2fbd3ff01688f354c57ae50b71c594e2304ba61484b32d451a931583
-
memory/572-59-0x0000000000000000-mapping.dmp
-
memory/572-77-0x000000006EE60000-0x000000006F40B000-memory.dmpFilesize
5.7MB
-
memory/572-76-0x000000006EE60000-0x000000006F40B000-memory.dmpFilesize
5.7MB
-
memory/828-61-0x0000000000000000-mapping.dmp
-
memory/892-63-0x0000000007EC0000-0x0000000007F1C000-memory.dmpFilesize
368KB
-
memory/892-58-0x0000000005E60000-0x0000000005EF6000-memory.dmpFilesize
600KB
-
memory/892-57-0x0000000000510000-0x000000000051E000-memory.dmpFilesize
56KB
-
memory/892-54-0x0000000000EA0000-0x0000000000F82000-memory.dmpFilesize
904KB
-
memory/892-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmpFilesize
8KB
-
memory/892-56-0x00000000004F0000-0x0000000000506000-memory.dmpFilesize
88KB
-
memory/1692-68-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1692-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1692-69-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1692-70-0x000000000043243E-mapping.dmp
-
memory/1692-72-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1692-74-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1692-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1692-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB