Analysis
-
max time kernel
169s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2022 19:18
Static task
static1
Behavioral task
behavioral1
Sample
Sales Contract.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Sales Contract.exe
Resource
win10v2004-20221111-en
General
-
Target
Sales Contract.exe
-
Size
814KB
-
MD5
2ffe57a9542324cb976388289368e47f
-
SHA1
0141d58dc4327faeb76da5152c2d83003c2dd90c
-
SHA256
83aa41a7f164cf8e0d298b48a95f406560e3c49d42dfc7f0430eb54f61840add
-
SHA512
f458f21a6305adae267e2d4fa48f4af5f43170bd1dfbad2c5455b87b2f0737fed83cbc610491549252b4d9f4f17156bcee89d25e396830dfe8f6de0e6a01c7cb
-
SSDEEP
12288:2EVq7T/tR1CU7PXlZGx5HHfB1xMqLppKlSwx7IkNa:In1mU765H51xMq6Qw+ma
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.svcnc.com - Port:
587 - Username:
krupakar@svcnc.com - Password:
Krupashine@6791 - Email To:
decenmomodou20@gmail.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Sales Contract.exedescription pid process target process PID 4268 set thread context of 4280 4268 Sales Contract.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
RegSvcs.exepid process 4280 RegSvcs.exe 4280 RegSvcs.exe 4280 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 4280 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Sales Contract.exedescription pid process target process PID 4268 wrote to memory of 4280 4268 Sales Contract.exe RegSvcs.exe PID 4268 wrote to memory of 4280 4268 Sales Contract.exe RegSvcs.exe PID 4268 wrote to memory of 4280 4268 Sales Contract.exe RegSvcs.exe PID 4268 wrote to memory of 4280 4268 Sales Contract.exe RegSvcs.exe PID 4268 wrote to memory of 4280 4268 Sales Contract.exe RegSvcs.exe PID 4268 wrote to memory of 4280 4268 Sales Contract.exe RegSvcs.exe PID 4268 wrote to memory of 4280 4268 Sales Contract.exe RegSvcs.exe PID 4268 wrote to memory of 4280 4268 Sales Contract.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sales Contract.exe"C:\Users\Admin\AppData\Local\Temp\Sales Contract.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4268-132-0x0000000000CB0000-0x0000000000D82000-memory.dmpFilesize
840KB
-
memory/4268-133-0x0000000005D70000-0x0000000006314000-memory.dmpFilesize
5.6MB
-
memory/4268-134-0x0000000005710000-0x00000000057A2000-memory.dmpFilesize
584KB
-
memory/4268-135-0x0000000005860000-0x00000000058FC000-memory.dmpFilesize
624KB
-
memory/4268-136-0x00000000057D0000-0x00000000057DA000-memory.dmpFilesize
40KB
-
memory/4280-137-0x0000000000000000-mapping.dmp
-
memory/4280-138-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/4280-139-0x0000000006300000-0x0000000006366000-memory.dmpFilesize
408KB
-
memory/4280-140-0x0000000006610000-0x0000000006660000-memory.dmpFilesize
320KB