Analysis
-
max time kernel
102s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
08-12-2022 12:01
Static task
static1
Behavioral task
behavioral1
Sample
1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe
Resource
win10v2004-20220901-en
General
-
Target
1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe
-
Size
841KB
-
MD5
9ae56d69920ad0f86e565db4c1be538f
-
SHA1
e02013cfe11f61d5490d7cd080da03bf662fb489
-
SHA256
1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3
-
SHA512
551d70df92e19fdcf064e104cde150ebf17468a3bc5929ab653dbd8ad9ddef3c6242f13549161bcb0f227344fe83539c37a3eac59a5fed5144ce7bd6c905a85b
-
SSDEEP
24576:sNABfegjab/IprMPJ6yIIwBvBWB4DhCA:sNAVab/ISPIIwjrs
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.symmdentaesthetics.com/ - Port:
21 - Username:
mob@symmdentaesthetics.com - Password:
mobility
Protocol: ftp- Host:
ftp://ftp.symmdentaesthetics.com/ - Port:
21 - Username:
mob@symmdentaesthetics.com - Password:
mobility
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4596-143-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exedescription pid process target process PID 5044 set thread context of 4596 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exepowershell.exe1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exepid process 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe 892 powershell.exe 892 powershell.exe 4596 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe 4596 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exepowershell.exe1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exedescription pid process Token: SeDebugPrivilege 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe Token: SeDebugPrivilege 892 powershell.exe Token: SeDebugPrivilege 4596 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exedescription pid process target process PID 5044 wrote to memory of 892 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe powershell.exe PID 5044 wrote to memory of 892 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe powershell.exe PID 5044 wrote to memory of 892 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe powershell.exe PID 5044 wrote to memory of 4788 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe schtasks.exe PID 5044 wrote to memory of 4788 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe schtasks.exe PID 5044 wrote to memory of 4788 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe schtasks.exe PID 5044 wrote to memory of 4596 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe PID 5044 wrote to memory of 4596 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe PID 5044 wrote to memory of 4596 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe PID 5044 wrote to memory of 4596 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe PID 5044 wrote to memory of 4596 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe PID 5044 wrote to memory of 4596 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe PID 5044 wrote to memory of 4596 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe PID 5044 wrote to memory of 4596 5044 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe -
outlook_office_path 1 IoCs
Processes:
1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe -
outlook_win_path 1 IoCs
Processes:
1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe"C:\Users\Admin\AppData\Local\Temp\1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UcgxIaRT.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UcgxIaRT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7947.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe"C:\Users\Admin\AppData\Local\Temp\1668fa70cde6e9a1376528c23e8d4fecc9267ae0473963ec8126e4836a7855d3.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7947.tmpFilesize
1KB
MD5bf5319c3662a559df35582d99553a847
SHA1458fb503faeda0f73698118c143df8cd087abf67
SHA256904fb150428120f19bffcea74d238b6f3eb8556ceaa5e117110c963aa001f9d1
SHA5122c50eaab2c99dfea2039ef6c03695167bb2f472a5f1bca6e37a81b810f54e5e2617d4de3a8450eb2c5a1d3ab7c1ac9419f3fb0489f59b1939ea25c5b197e95d9
-
memory/892-150-0x0000000006E10000-0x0000000006E2E000-memory.dmpFilesize
120KB
-
memory/892-137-0x0000000000000000-mapping.dmp
-
memory/892-145-0x00000000061A0000-0x0000000006206000-memory.dmpFilesize
408KB
-
memory/892-157-0x0000000007EA0000-0x0000000007EA8000-memory.dmpFilesize
32KB
-
memory/892-146-0x0000000006210000-0x0000000006276000-memory.dmpFilesize
408KB
-
memory/892-156-0x0000000007EC0000-0x0000000007EDA000-memory.dmpFilesize
104KB
-
memory/892-139-0x0000000002F50000-0x0000000002F86000-memory.dmpFilesize
216KB
-
memory/892-147-0x0000000006870000-0x000000000688E000-memory.dmpFilesize
120KB
-
memory/892-141-0x0000000005980000-0x0000000005FA8000-memory.dmpFilesize
6.2MB
-
memory/892-155-0x0000000007DB0000-0x0000000007DBE000-memory.dmpFilesize
56KB
-
memory/892-154-0x0000000007E00000-0x0000000007E96000-memory.dmpFilesize
600KB
-
memory/892-144-0x00000000057A0000-0x00000000057C2000-memory.dmpFilesize
136KB
-
memory/892-153-0x0000000007BF0000-0x0000000007BFA000-memory.dmpFilesize
40KB
-
memory/892-152-0x0000000007B80000-0x0000000007B9A000-memory.dmpFilesize
104KB
-
memory/892-151-0x00000000081C0000-0x000000000883A000-memory.dmpFilesize
6.5MB
-
memory/892-148-0x0000000006E60000-0x0000000006E92000-memory.dmpFilesize
200KB
-
memory/892-149-0x0000000070450000-0x000000007049C000-memory.dmpFilesize
304KB
-
memory/4596-143-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/4596-142-0x0000000000000000-mapping.dmp
-
memory/4788-138-0x0000000000000000-mapping.dmp
-
memory/5044-132-0x0000000000CD0000-0x0000000000DA8000-memory.dmpFilesize
864KB
-
memory/5044-133-0x0000000005B60000-0x0000000006104000-memory.dmpFilesize
5.6MB
-
memory/5044-134-0x0000000005650000-0x00000000056E2000-memory.dmpFilesize
584KB
-
memory/5044-135-0x0000000005610000-0x000000000561A000-memory.dmpFilesize
40KB
-
memory/5044-136-0x00000000093D0000-0x000000000946C000-memory.dmpFilesize
624KB