Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
14-01-2023 12:55
Static task
static1
Behavioral task
behavioral1
Sample
6def904f769fe8ef1e3da3e4305fd36fc162176a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6def904f769fe8ef1e3da3e4305fd36fc162176a.exe
Resource
win10v2004-20221111-en
General
-
Target
6def904f769fe8ef1e3da3e4305fd36fc162176a.exe
-
Size
434KB
-
MD5
f25a05273ba3897ae6d5211dd42bf896
-
SHA1
6def904f769fe8ef1e3da3e4305fd36fc162176a
-
SHA256
87e32aa4c7cdad4872573c0d62e51e9256d1c774dbdebd2cb2e706734aa69e1f
-
SHA512
52050da9da3a70d4c39a05ebfb720998b0b98c077b6996985cce7924711389df7196da8d85e53723b24f17c311dab0551b087161283d46ba1756f6cd2d06f0a2
-
SSDEEP
6144:uYa63eDljYsa/ahTp42vAHkp2xv/hQ8MUlEeYBbE:uYMlMsgET1vRp2VpQ8MuvYBbE
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.sseximclearing.com - Port:
587 - Username:
[email protected] - Password:
Ssxm@9854 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE 2 IoCs
pid Process 1560 ochfhrpklc.exe 940 ochfhrpklc.exe -
Loads dropped DLL 3 IoCs
pid Process 1788 6def904f769fe8ef1e3da3e4305fd36fc162176a.exe 1788 6def904f769fe8ef1e3da3e4305fd36fc162176a.exe 1560 ochfhrpklc.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ochfhrpklc.exe Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ochfhrpklc.exe Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ochfhrpklc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1560 set thread context of 940 1560 ochfhrpklc.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 940 ochfhrpklc.exe 940 ochfhrpklc.exe 940 ochfhrpklc.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1560 ochfhrpklc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 940 ochfhrpklc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1788 wrote to memory of 1560 1788 6def904f769fe8ef1e3da3e4305fd36fc162176a.exe 27 PID 1788 wrote to memory of 1560 1788 6def904f769fe8ef1e3da3e4305fd36fc162176a.exe 27 PID 1788 wrote to memory of 1560 1788 6def904f769fe8ef1e3da3e4305fd36fc162176a.exe 27 PID 1788 wrote to memory of 1560 1788 6def904f769fe8ef1e3da3e4305fd36fc162176a.exe 27 PID 1560 wrote to memory of 940 1560 ochfhrpklc.exe 28 PID 1560 wrote to memory of 940 1560 ochfhrpklc.exe 28 PID 1560 wrote to memory of 940 1560 ochfhrpklc.exe 28 PID 1560 wrote to memory of 940 1560 ochfhrpklc.exe 28 PID 1560 wrote to memory of 940 1560 ochfhrpklc.exe 28 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ochfhrpklc.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ochfhrpklc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6def904f769fe8ef1e3da3e4305fd36fc162176a.exe"C:\Users\Admin\AppData\Local\Temp\6def904f769fe8ef1e3da3e4305fd36fc162176a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\ochfhrpklc.exe"C:\Users\Admin\AppData\Local\Temp\ochfhrpklc.exe" C:\Users\Admin\AppData\Local\Temp\ntiydcsvzue.u2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\ochfhrpklc.exe"C:\Users\Admin\AppData\Local\Temp\ochfhrpklc.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:940
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257KB
MD59ce837ddd9c3ba9a65e8aa2061defbd9
SHA14af697e1d0d7c2dfd8fd552580b8948d768ff423
SHA256933f60a21c64c1a5f767e08687c8a3a1911cef0563bb5b343976eb825120fc5f
SHA512dd0cb28238ecfbb67d6247d598b9607905b63fc08698ac4ef8f985d2368c4676d6570d9c09dc74aa6c365bf839fce3947f091391251f945802e30e73f882b1b5
-
Filesize
5KB
MD53914eef11e7aca508d6e14e269d597f4
SHA12b827136201c218943454bee4ae44d41dc8e8ec8
SHA25660813c76ce5cb6ce27ffbb799e6c6512aace4bfca2f4e3038f04af7787ac9d30
SHA5126e59778780dc6718114033942251d4686933018e1a36dc32bd615d0c83d15be2b5a4b2110da660020d7d944ad020245ea0ea9d8163f06b8db3d06fb1d01f0c97
-
Filesize
48KB
MD59abb06e414e784d09eb96997b2d1a336
SHA1d7956125a07ccc073b61f71eefc0e5e89c465487
SHA2563b302c0f09b1cd5a77debd01211ff4c0ae0cca86c781ea4f901e7a3026ac4db5
SHA51224e786796403f159cbd371ae43e52692ec46ebff16365a3cb9948962b64a8befdb21acac1eb1ea654c0fff01d46224a120069a9d6336e5c8f895c88e8a051281
-
Filesize
48KB
MD59abb06e414e784d09eb96997b2d1a336
SHA1d7956125a07ccc073b61f71eefc0e5e89c465487
SHA2563b302c0f09b1cd5a77debd01211ff4c0ae0cca86c781ea4f901e7a3026ac4db5
SHA51224e786796403f159cbd371ae43e52692ec46ebff16365a3cb9948962b64a8befdb21acac1eb1ea654c0fff01d46224a120069a9d6336e5c8f895c88e8a051281
-
Filesize
48KB
MD59abb06e414e784d09eb96997b2d1a336
SHA1d7956125a07ccc073b61f71eefc0e5e89c465487
SHA2563b302c0f09b1cd5a77debd01211ff4c0ae0cca86c781ea4f901e7a3026ac4db5
SHA51224e786796403f159cbd371ae43e52692ec46ebff16365a3cb9948962b64a8befdb21acac1eb1ea654c0fff01d46224a120069a9d6336e5c8f895c88e8a051281
-
Filesize
48KB
MD59abb06e414e784d09eb96997b2d1a336
SHA1d7956125a07ccc073b61f71eefc0e5e89c465487
SHA2563b302c0f09b1cd5a77debd01211ff4c0ae0cca86c781ea4f901e7a3026ac4db5
SHA51224e786796403f159cbd371ae43e52692ec46ebff16365a3cb9948962b64a8befdb21acac1eb1ea654c0fff01d46224a120069a9d6336e5c8f895c88e8a051281
-
Filesize
48KB
MD59abb06e414e784d09eb96997b2d1a336
SHA1d7956125a07ccc073b61f71eefc0e5e89c465487
SHA2563b302c0f09b1cd5a77debd01211ff4c0ae0cca86c781ea4f901e7a3026ac4db5
SHA51224e786796403f159cbd371ae43e52692ec46ebff16365a3cb9948962b64a8befdb21acac1eb1ea654c0fff01d46224a120069a9d6336e5c8f895c88e8a051281
-
Filesize
48KB
MD59abb06e414e784d09eb96997b2d1a336
SHA1d7956125a07ccc073b61f71eefc0e5e89c465487
SHA2563b302c0f09b1cd5a77debd01211ff4c0ae0cca86c781ea4f901e7a3026ac4db5
SHA51224e786796403f159cbd371ae43e52692ec46ebff16365a3cb9948962b64a8befdb21acac1eb1ea654c0fff01d46224a120069a9d6336e5c8f895c88e8a051281