Analysis
-
max time kernel
65s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-01-2023 07:10
Static task
static1
Behavioral task
behavioral1
Sample
bccb28e85cdebace63745f82f9aee710e636a8d1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bccb28e85cdebace63745f82f9aee710e636a8d1.exe
Resource
win10v2004-20220812-en
General
-
Target
bccb28e85cdebace63745f82f9aee710e636a8d1.exe
-
Size
667KB
-
MD5
873a1ee0a525f7352000a3c5915e2120
-
SHA1
bccb28e85cdebace63745f82f9aee710e636a8d1
-
SHA256
7a5b7449fcd765f1a3be1dc0c8286cb46afe94b8c8040a0d268b27fe8d658ee4
-
SHA512
85c00901c7f74ce3173eb9f28adb71ed929415a866faa640d7ef3d09fa0c16cc8d31bd7025a439d9e114841d7900a9166155f68b062da79f3143383d2b479aa1
-
SSDEEP
12288:uY1xSo1bDnyLXnT0mes/HwMeCw8NdDw9j6bjUdt38TAhHqjj6yB5fta:uYXTnyrgNCw8N26XUdt8AhYj6yB5fta
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
hnxqezadblabdsss
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE 2 IoCs
pid Process 1940 wfbara.exe 1136 wfbara.exe -
Loads dropped DLL 3 IoCs
pid Process 1664 bccb28e85cdebace63745f82f9aee710e636a8d1.exe 1664 bccb28e85cdebace63745f82f9aee710e636a8d1.exe 1940 wfbara.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wfbara.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wfbara.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wfbara.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1940 set thread context of 1136 1940 wfbara.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1136 wfbara.exe 1136 wfbara.exe 1136 wfbara.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1940 wfbara.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1136 wfbara.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1136 wfbara.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1664 wrote to memory of 1940 1664 bccb28e85cdebace63745f82f9aee710e636a8d1.exe 28 PID 1664 wrote to memory of 1940 1664 bccb28e85cdebace63745f82f9aee710e636a8d1.exe 28 PID 1664 wrote to memory of 1940 1664 bccb28e85cdebace63745f82f9aee710e636a8d1.exe 28 PID 1664 wrote to memory of 1940 1664 bccb28e85cdebace63745f82f9aee710e636a8d1.exe 28 PID 1940 wrote to memory of 1136 1940 wfbara.exe 30 PID 1940 wrote to memory of 1136 1940 wfbara.exe 30 PID 1940 wrote to memory of 1136 1940 wfbara.exe 30 PID 1940 wrote to memory of 1136 1940 wfbara.exe 30 PID 1940 wrote to memory of 1136 1940 wfbara.exe 30 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wfbara.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 wfbara.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bccb28e85cdebace63745f82f9aee710e636a8d1.exe"C:\Users\Admin\AppData\Local\Temp\bccb28e85cdebace63745f82f9aee710e636a8d1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\wfbara.exe"C:\Users\Admin\AppData\Local\Temp\wfbara.exe" C:\Users\Admin\AppData\Local\Temp\ljeqsvcix.cr2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\wfbara.exe"C:\Users\Admin\AppData\Local\Temp\wfbara.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1136
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
294KB
MD5d3a84f5b09d771d23b0e7a1d477833be
SHA1f3c895e1949dadffe19f18dea64716a71b42d87c
SHA2569a84b8d22977e61b7b827065318877e50487036694720cab09413d874751b21a
SHA51246abc1f80167450e6a4761f4e1c88f69bbc57bfd92ac5b689393e7c16f419a76f9e1d5cc8a166f1f327814d9183fe1370131b8bbb102c2d49199ea3848723ed9
-
Filesize
5KB
MD537253aa811b5368db29a69b7f433e7c8
SHA198c2ba3f2935c8f89dd0a6fad9e1f9e0fda281e7
SHA2565d19c8234ba80d87e571fbc1fab0c96ef5f42b4e8f660e1cf6e96c2d21627cf5
SHA512edf9652a3afb7bd4c4ef2b18bf8b4f7be65230a0709f994c334488094118ea54f3f6e3364006cc63ebc051726a2d7c633d93d710433e2b7cdd5e0f56e789dae9
-
Filesize
84KB
MD5764a308bfd438d57e87373e1f8142eb0
SHA16603faacb96675f5ad4aaa94c971a0aeccd545c1
SHA256676eaa5fde1354b95c484cf67f37f43bb94821c851bbbbb3098de1f1a37da14b
SHA5128a97936073375ccaf26f42248a3546d8956c3effd46dccf8a7c7e32b0afb374176e461488bea1e779d34e43f321c2102c7d0e8d3b0d2777f228292e22f9b1c6a
-
Filesize
84KB
MD5764a308bfd438d57e87373e1f8142eb0
SHA16603faacb96675f5ad4aaa94c971a0aeccd545c1
SHA256676eaa5fde1354b95c484cf67f37f43bb94821c851bbbbb3098de1f1a37da14b
SHA5128a97936073375ccaf26f42248a3546d8956c3effd46dccf8a7c7e32b0afb374176e461488bea1e779d34e43f321c2102c7d0e8d3b0d2777f228292e22f9b1c6a
-
Filesize
84KB
MD5764a308bfd438d57e87373e1f8142eb0
SHA16603faacb96675f5ad4aaa94c971a0aeccd545c1
SHA256676eaa5fde1354b95c484cf67f37f43bb94821c851bbbbb3098de1f1a37da14b
SHA5128a97936073375ccaf26f42248a3546d8956c3effd46dccf8a7c7e32b0afb374176e461488bea1e779d34e43f321c2102c7d0e8d3b0d2777f228292e22f9b1c6a
-
Filesize
84KB
MD5764a308bfd438d57e87373e1f8142eb0
SHA16603faacb96675f5ad4aaa94c971a0aeccd545c1
SHA256676eaa5fde1354b95c484cf67f37f43bb94821c851bbbbb3098de1f1a37da14b
SHA5128a97936073375ccaf26f42248a3546d8956c3effd46dccf8a7c7e32b0afb374176e461488bea1e779d34e43f321c2102c7d0e8d3b0d2777f228292e22f9b1c6a
-
Filesize
84KB
MD5764a308bfd438d57e87373e1f8142eb0
SHA16603faacb96675f5ad4aaa94c971a0aeccd545c1
SHA256676eaa5fde1354b95c484cf67f37f43bb94821c851bbbbb3098de1f1a37da14b
SHA5128a97936073375ccaf26f42248a3546d8956c3effd46dccf8a7c7e32b0afb374176e461488bea1e779d34e43f321c2102c7d0e8d3b0d2777f228292e22f9b1c6a
-
Filesize
84KB
MD5764a308bfd438d57e87373e1f8142eb0
SHA16603faacb96675f5ad4aaa94c971a0aeccd545c1
SHA256676eaa5fde1354b95c484cf67f37f43bb94821c851bbbbb3098de1f1a37da14b
SHA5128a97936073375ccaf26f42248a3546d8956c3effd46dccf8a7c7e32b0afb374176e461488bea1e779d34e43f321c2102c7d0e8d3b0d2777f228292e22f9b1c6a