Analysis
-
max time kernel
51s -
max time network
64s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
02-02-2023 14:12
Static task
static1
Behavioral task
behavioral1
Sample
7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exe
Resource
win10-20220901-en
General
-
Target
7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exe
-
Size
17KB
-
MD5
a40459f1f741836d46666ce9b97a191c
-
SHA1
2bc5fad1d7906cca69973978854c55631bdf5513
-
SHA256
7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787
-
SHA512
c0bacf88707bd9572656d1eed5bda093262d69f1d699281175117f3afa2dfc8b1c71105c12ce706393166d1e366e98c79d893a5c315278572b60081faa3983ea
-
SSDEEP
192:wA1NdkCT9ktcs4AZ/Daryr13kQfwvxk4Hkq7n:eCT9MZ/D2yrlffkxtt7
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.expostore.pk - Port:
587 - Username:
info@expostore.pk - Password:
Expostore12345@@ - Email To:
mylogs456@gmail.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2744-197-0x0000000005D30000-0x0000000005F98000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exe Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exe Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exe7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exepid process 3048 powershell.exe 3048 powershell.exe 3048 powershell.exe 2744 7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exe 2744 7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exe 2744 7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exepowershell.exedescription pid process Token: SeDebugPrivilege 2744 7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exe Token: SeDebugPrivilege 3048 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exedescription pid process target process PID 2744 wrote to memory of 3048 2744 7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exe powershell.exe PID 2744 wrote to memory of 3048 2744 7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exe powershell.exe PID 2744 wrote to memory of 3048 2744 7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exe powershell.exe -
outlook_office_path 1 IoCs
Processes:
7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exe -
outlook_win_path 1 IoCs
Processes:
7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exe"C:\Users\Admin\AppData\Local\Temp\7e1a5dbf82214247152ab46db0014c5aa53faa5c21b630900eabfbf795147787.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2744-162-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-148-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-122-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-123-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-124-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-125-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-126-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-127-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-128-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-129-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-130-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-131-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-132-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-133-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-134-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-135-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-136-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-137-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-138-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-139-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-140-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-141-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-142-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-143-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-144-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-145-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-146-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-164-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-163-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-149-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-120-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-151-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-152-0x00000000002D0000-0x00000000002DA000-memory.dmpFilesize
40KB
-
memory/2744-153-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-154-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-155-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-156-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-157-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-158-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-159-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-160-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-161-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-150-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-121-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-147-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-165-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-166-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-167-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-168-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-169-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-170-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-171-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-172-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-173-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-174-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-175-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-176-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-177-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-178-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-179-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-180-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-181-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-182-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-183-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-184-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-197-0x0000000005D30000-0x0000000005F98000-memory.dmpFilesize
2.4MB
-
memory/2744-198-0x00000000061D0000-0x00000000061F2000-memory.dmpFilesize
136KB
-
memory/2744-200-0x0000000006470000-0x00000000067C0000-memory.dmpFilesize
3.3MB
-
memory/2744-298-0x0000000005270000-0x00000000052C8000-memory.dmpFilesize
352KB
-
memory/2744-299-0x00000000052D0000-0x000000000530C000-memory.dmpFilesize
240KB
-
memory/2744-300-0x0000000007010000-0x000000000750E000-memory.dmpFilesize
5.0MB
-
memory/2744-301-0x00000000054B0000-0x000000000554C000-memory.dmpFilesize
624KB
-
memory/2744-310-0x0000000005900000-0x0000000005918000-memory.dmpFilesize
96KB
-
memory/2744-318-0x0000000006B70000-0x0000000006B7A000-memory.dmpFilesize
40KB
-
memory/2744-315-0x0000000006B90000-0x0000000006C22000-memory.dmpFilesize
584KB
-
memory/3048-252-0x0000000007550000-0x0000000007B78000-memory.dmpFilesize
6.2MB
-
memory/3048-271-0x0000000007CB0000-0x0000000007D16000-memory.dmpFilesize
408KB
-
memory/3048-272-0x0000000007FA0000-0x0000000008006000-memory.dmpFilesize
408KB
-
memory/3048-247-0x0000000006EC0000-0x0000000006EF6000-memory.dmpFilesize
216KB
-
memory/3048-211-0x0000000000000000-mapping.dmp
-
memory/3048-275-0x0000000007F70000-0x0000000007F8C000-memory.dmpFilesize
112KB
-
memory/3048-276-0x00000000083D0000-0x000000000841B000-memory.dmpFilesize
300KB
-
memory/3048-280-0x0000000008650000-0x00000000086C6000-memory.dmpFilesize
472KB
-
memory/3048-291-0x0000000009D50000-0x000000000A3C8000-memory.dmpFilesize
6.5MB
-
memory/3048-292-0x00000000094B0000-0x00000000094CA000-memory.dmpFilesize
104KB