Analysis
-
max time kernel
91s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2023 14:46
Static task
static1
Behavioral task
behavioral1
Sample
URGENT REQUEST.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
URGENT REQUEST.exe
Resource
win10v2004-20220812-en
General
-
Target
URGENT REQUEST.exe
-
Size
64KB
-
MD5
3031228682ee992a8c75b0b7e767b794
-
SHA1
c0beabc62747ee62fbb05eb35284cc382a9a25fe
-
SHA256
2b7d52cff6d8153c70e007f4b88b38788b6205144cb65c60b76272dc838acc8b
-
SHA512
4fbadca7a43b04946afab52fd39e7de1ce34677d93316ff1f471105331af29e9787979fd6a6c3be2e1d6be0253fbd2b67c6f5963b618ebdeec030a77e49254aa
-
SSDEEP
768:EkOyF9AKzI19Nn7cx4vn+vEqMtpYYkhN40LO6dusn04eF:xOe9AA49Nn7cxgMEqMt8N40ymuL3F
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
focuzpartsmart.com - Port:
587 - Username:
[email protected] - Password:
FpmJhn@2023 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
URGENT REQUEST.exedescription pid process target process PID 1048 set thread context of 1712 1048 URGENT REQUEST.exe AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AddInProcess32.exedescription pid process Token: SeDebugPrivilege 1712 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
URGENT REQUEST.exedescription pid process target process PID 1048 wrote to memory of 1712 1048 URGENT REQUEST.exe AddInProcess32.exe PID 1048 wrote to memory of 1712 1048 URGENT REQUEST.exe AddInProcess32.exe PID 1048 wrote to memory of 1712 1048 URGENT REQUEST.exe AddInProcess32.exe PID 1048 wrote to memory of 1712 1048 URGENT REQUEST.exe AddInProcess32.exe PID 1048 wrote to memory of 1712 1048 URGENT REQUEST.exe AddInProcess32.exe PID 1048 wrote to memory of 1712 1048 URGENT REQUEST.exe AddInProcess32.exe PID 1048 wrote to memory of 1712 1048 URGENT REQUEST.exe AddInProcess32.exe PID 1048 wrote to memory of 1712 1048 URGENT REQUEST.exe AddInProcess32.exe -
outlook_office_path 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe -
outlook_win_path 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\URGENT REQUEST.exe"C:\Users\Admin\AppData\Local\Temp\URGENT REQUEST.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1048-132-0x000001D6380D0000-0x000001D6380E4000-memory.dmpFilesize
80KB
-
memory/1048-133-0x00007FFE2FEB0000-0x00007FFE30971000-memory.dmpFilesize
10.8MB
-
memory/1048-136-0x00007FFE2FEB0000-0x00007FFE30971000-memory.dmpFilesize
10.8MB
-
memory/1712-134-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1712-135-0x000000000042A62E-mapping.dmp
-
memory/1712-137-0x0000000005E40000-0x00000000063E4000-memory.dmpFilesize
5.6MB
-
memory/1712-138-0x0000000005900000-0x0000000005966000-memory.dmpFilesize
408KB
-
memory/1712-139-0x0000000006A50000-0x0000000006AE2000-memory.dmpFilesize
584KB
-
memory/1712-140-0x0000000006A20000-0x0000000006A2A000-memory.dmpFilesize
40KB
-
memory/1712-141-0x0000000006C30000-0x0000000006C80000-memory.dmpFilesize
320KB
-
memory/1712-142-0x0000000006E50000-0x0000000007012000-memory.dmpFilesize
1.8MB