Analysis
-
max time kernel
68s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07-12-2022 19:18
Static task
static1
Behavioral task
behavioral1
Sample
Sales Contract.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Sales Contract.exe
Resource
win10v2004-20221111-en
General
-
Target
Sales Contract.exe
-
Size
814KB
-
MD5
2ffe57a9542324cb976388289368e47f
-
SHA1
0141d58dc4327faeb76da5152c2d83003c2dd90c
-
SHA256
83aa41a7f164cf8e0d298b48a95f406560e3c49d42dfc7f0430eb54f61840add
-
SHA512
f458f21a6305adae267e2d4fa48f4af5f43170bd1dfbad2c5455b87b2f0737fed83cbc610491549252b4d9f4f17156bcee89d25e396830dfe8f6de0e6a01c7cb
-
SSDEEP
12288:2EVq7T/tR1CU7PXlZGx5HHfB1xMqLppKlSwx7IkNa:In1mU765H51xMq6Qw+ma
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.svcnc.com - Port:
587 - Username:
[email protected] - Password:
Krupashine@6791 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Sales Contract.exedescription pid process target process PID 1708 set thread context of 768 1708 Sales Contract.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
RegSvcs.exepid process 768 RegSvcs.exe 768 RegSvcs.exe 768 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 768 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Sales Contract.exedescription pid process target process PID 1708 wrote to memory of 768 1708 Sales Contract.exe RegSvcs.exe PID 1708 wrote to memory of 768 1708 Sales Contract.exe RegSvcs.exe PID 1708 wrote to memory of 768 1708 Sales Contract.exe RegSvcs.exe PID 1708 wrote to memory of 768 1708 Sales Contract.exe RegSvcs.exe PID 1708 wrote to memory of 768 1708 Sales Contract.exe RegSvcs.exe PID 1708 wrote to memory of 768 1708 Sales Contract.exe RegSvcs.exe PID 1708 wrote to memory of 768 1708 Sales Contract.exe RegSvcs.exe PID 1708 wrote to memory of 768 1708 Sales Contract.exe RegSvcs.exe PID 1708 wrote to memory of 768 1708 Sales Contract.exe RegSvcs.exe PID 1708 wrote to memory of 768 1708 Sales Contract.exe RegSvcs.exe PID 1708 wrote to memory of 768 1708 Sales Contract.exe RegSvcs.exe PID 1708 wrote to memory of 768 1708 Sales Contract.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sales Contract.exe"C:\Users\Admin\AppData\Local\Temp\Sales Contract.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/768-64-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/768-59-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/768-60-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/768-62-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/768-63-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/768-65-0x0000000000437B2E-mapping.dmp
-
memory/768-67-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/768-69-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1708-55-0x0000000075111000-0x0000000075113000-memory.dmpFilesize
8KB
-
memory/1708-56-0x00000000002B0000-0x00000000002C2000-memory.dmpFilesize
72KB
-
memory/1708-57-0x0000000004FB0000-0x0000000005042000-memory.dmpFilesize
584KB
-
memory/1708-58-0x0000000002040000-0x0000000002094000-memory.dmpFilesize
336KB
-
memory/1708-54-0x0000000000300000-0x00000000003D2000-memory.dmpFilesize
840KB