Analysis

  • max time kernel
    65s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06-01-2023 07:10

General

  • Target

    bccb28e85cdebace63745f82f9aee710e636a8d1.exe

  • Size

    667KB

  • MD5

    873a1ee0a525f7352000a3c5915e2120

  • SHA1

    bccb28e85cdebace63745f82f9aee710e636a8d1

  • SHA256

    7a5b7449fcd765f1a3be1dc0c8286cb46afe94b8c8040a0d268b27fe8d658ee4

  • SHA512

    85c00901c7f74ce3173eb9f28adb71ed929415a866faa640d7ef3d09fa0c16cc8d31bd7025a439d9e114841d7900a9166155f68b062da79f3143383d2b479aa1

  • SSDEEP

    12288:uY1xSo1bDnyLXnT0mes/HwMeCw8NdDw9j6bjUdt38TAhHqjj6yB5fta:uYXTnyrgNCw8N26XUdt8AhYj6yB5fta

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    hnxqezadblabdsss

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bccb28e85cdebace63745f82f9aee710e636a8d1.exe
    "C:\Users\Admin\AppData\Local\Temp\bccb28e85cdebace63745f82f9aee710e636a8d1.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Users\Admin\AppData\Local\Temp\wfbara.exe
      "C:\Users\Admin\AppData\Local\Temp\wfbara.exe" C:\Users\Admin\AppData\Local\Temp\ljeqsvcix.cr
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1940
      • C:\Users\Admin\AppData\Local\Temp\wfbara.exe
        "C:\Users\Admin\AppData\Local\Temp\wfbara.exe"
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • outlook_office_path
        • outlook_win_path
        PID:1136

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\eevmqfrpo.nw

    Filesize

    294KB

    MD5

    d3a84f5b09d771d23b0e7a1d477833be

    SHA1

    f3c895e1949dadffe19f18dea64716a71b42d87c

    SHA256

    9a84b8d22977e61b7b827065318877e50487036694720cab09413d874751b21a

    SHA512

    46abc1f80167450e6a4761f4e1c88f69bbc57bfd92ac5b689393e7c16f419a76f9e1d5cc8a166f1f327814d9183fe1370131b8bbb102c2d49199ea3848723ed9

  • C:\Users\Admin\AppData\Local\Temp\ljeqsvcix.cr

    Filesize

    5KB

    MD5

    37253aa811b5368db29a69b7f433e7c8

    SHA1

    98c2ba3f2935c8f89dd0a6fad9e1f9e0fda281e7

    SHA256

    5d19c8234ba80d87e571fbc1fab0c96ef5f42b4e8f660e1cf6e96c2d21627cf5

    SHA512

    edf9652a3afb7bd4c4ef2b18bf8b4f7be65230a0709f994c334488094118ea54f3f6e3364006cc63ebc051726a2d7c633d93d710433e2b7cdd5e0f56e789dae9

  • C:\Users\Admin\AppData\Local\Temp\wfbara.exe

    Filesize

    84KB

    MD5

    764a308bfd438d57e87373e1f8142eb0

    SHA1

    6603faacb96675f5ad4aaa94c971a0aeccd545c1

    SHA256

    676eaa5fde1354b95c484cf67f37f43bb94821c851bbbbb3098de1f1a37da14b

    SHA512

    8a97936073375ccaf26f42248a3546d8956c3effd46dccf8a7c7e32b0afb374176e461488bea1e779d34e43f321c2102c7d0e8d3b0d2777f228292e22f9b1c6a

  • C:\Users\Admin\AppData\Local\Temp\wfbara.exe

    Filesize

    84KB

    MD5

    764a308bfd438d57e87373e1f8142eb0

    SHA1

    6603faacb96675f5ad4aaa94c971a0aeccd545c1

    SHA256

    676eaa5fde1354b95c484cf67f37f43bb94821c851bbbbb3098de1f1a37da14b

    SHA512

    8a97936073375ccaf26f42248a3546d8956c3effd46dccf8a7c7e32b0afb374176e461488bea1e779d34e43f321c2102c7d0e8d3b0d2777f228292e22f9b1c6a

  • C:\Users\Admin\AppData\Local\Temp\wfbara.exe

    Filesize

    84KB

    MD5

    764a308bfd438d57e87373e1f8142eb0

    SHA1

    6603faacb96675f5ad4aaa94c971a0aeccd545c1

    SHA256

    676eaa5fde1354b95c484cf67f37f43bb94821c851bbbbb3098de1f1a37da14b

    SHA512

    8a97936073375ccaf26f42248a3546d8956c3effd46dccf8a7c7e32b0afb374176e461488bea1e779d34e43f321c2102c7d0e8d3b0d2777f228292e22f9b1c6a

  • \Users\Admin\AppData\Local\Temp\wfbara.exe

    Filesize

    84KB

    MD5

    764a308bfd438d57e87373e1f8142eb0

    SHA1

    6603faacb96675f5ad4aaa94c971a0aeccd545c1

    SHA256

    676eaa5fde1354b95c484cf67f37f43bb94821c851bbbbb3098de1f1a37da14b

    SHA512

    8a97936073375ccaf26f42248a3546d8956c3effd46dccf8a7c7e32b0afb374176e461488bea1e779d34e43f321c2102c7d0e8d3b0d2777f228292e22f9b1c6a

  • \Users\Admin\AppData\Local\Temp\wfbara.exe

    Filesize

    84KB

    MD5

    764a308bfd438d57e87373e1f8142eb0

    SHA1

    6603faacb96675f5ad4aaa94c971a0aeccd545c1

    SHA256

    676eaa5fde1354b95c484cf67f37f43bb94821c851bbbbb3098de1f1a37da14b

    SHA512

    8a97936073375ccaf26f42248a3546d8956c3effd46dccf8a7c7e32b0afb374176e461488bea1e779d34e43f321c2102c7d0e8d3b0d2777f228292e22f9b1c6a

  • \Users\Admin\AppData\Local\Temp\wfbara.exe

    Filesize

    84KB

    MD5

    764a308bfd438d57e87373e1f8142eb0

    SHA1

    6603faacb96675f5ad4aaa94c971a0aeccd545c1

    SHA256

    676eaa5fde1354b95c484cf67f37f43bb94821c851bbbbb3098de1f1a37da14b

    SHA512

    8a97936073375ccaf26f42248a3546d8956c3effd46dccf8a7c7e32b0afb374176e461488bea1e779d34e43f321c2102c7d0e8d3b0d2777f228292e22f9b1c6a

  • memory/1136-64-0x0000000000401896-mapping.dmp

  • memory/1136-67-0x0000000001FB0000-0x0000000001FE8000-memory.dmp

    Filesize

    224KB

  • memory/1136-68-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/1664-54-0x0000000076181000-0x0000000076183000-memory.dmp

    Filesize

    8KB

  • memory/1940-57-0x0000000000000000-mapping.dmp