Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
07-02-2023 00:56
Static task
static1
Behavioral task
behavioral1
Sample
1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe
Resource
win10v2004-20221111-en
General
-
Target
1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe
-
Size
350KB
-
MD5
30de9fdf74e679696573f243be4b43e9
-
SHA1
013ab418dc36cef10bdafcacc65485a28b292484
-
SHA256
1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d
-
SHA512
a137e199ffb4ff001545dd9875571520f41abfb449de7b1435899ca42d133051edc6b7c6bd4309caacc8cfdf98e8c0d3f60241a496cbe74dcb2243a4d24b13a3
-
SSDEEP
6144:/Ya60B2kYIxjohyIZ9olobwMg0dFr8YrCS0CuneQL50jpjC7XM/FKKnojCqKQBg:/YyB/YwcYWkobwM5uYrP0zeCmjg7XMtR
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE 2 IoCs
Processes:
mitzdyntn.exemitzdyntn.exepid process 3352 mitzdyntn.exe 2392 mitzdyntn.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
mitzdyntn.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mitzdyntn.exe Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mitzdyntn.exe Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mitzdyntn.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mitzdyntn.exedescription pid process target process PID 3352 set thread context of 2392 3352 mitzdyntn.exe mitzdyntn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
mitzdyntn.exepid process 2392 mitzdyntn.exe 2392 mitzdyntn.exe 2392 mitzdyntn.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
mitzdyntn.exepid process 3352 mitzdyntn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
mitzdyntn.exedescription pid process Token: SeDebugPrivilege 2392 mitzdyntn.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exemitzdyntn.exedescription pid process target process PID 2236 wrote to memory of 3352 2236 1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe mitzdyntn.exe PID 2236 wrote to memory of 3352 2236 1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe mitzdyntn.exe PID 2236 wrote to memory of 3352 2236 1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe mitzdyntn.exe PID 3352 wrote to memory of 2392 3352 mitzdyntn.exe mitzdyntn.exe PID 3352 wrote to memory of 2392 3352 mitzdyntn.exe mitzdyntn.exe PID 3352 wrote to memory of 2392 3352 mitzdyntn.exe mitzdyntn.exe PID 3352 wrote to memory of 2392 3352 mitzdyntn.exe mitzdyntn.exe -
outlook_office_path 1 IoCs
Processes:
mitzdyntn.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mitzdyntn.exe -
outlook_win_path 1 IoCs
Processes:
mitzdyntn.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 mitzdyntn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe"C:\Users\Admin\AppData\Local\Temp\1faddf5e3b51c7dae7f6f195da0a3b0abce5600bb3934f19dd5d111841741c9d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\mitzdyntn.exe"C:\Users\Admin\AppData\Local\Temp\mitzdyntn.exe" C:\Users\Admin\AppData\Local\Temp\wadoxpggn.zng2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\mitzdyntn.exe"C:\Users\Admin\AppData\Local\Temp\mitzdyntn.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2392
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dsnxlnrgcx.zsmFilesize
315KB
MD5394179249883a6361e95ff437b6ed10d
SHA1a60133e7d2139acde7303752a6830edf0069a324
SHA2562f2216852c5a57ef8203dc966ce50a6578edc801bd4c294dce1697403325eb90
SHA5124bc0f56cb4d814c486579983c1d190761702b51a3cd1d4cf871a3c1d1de1be657f7aa791f235e7610d8d340f86789e4f764c79c0a0dce2693fdfb5833d53742d
-
C:\Users\Admin\AppData\Local\Temp\mitzdyntn.exeFilesize
112KB
MD522714749e5ce66ce2db8b69f0490ecad
SHA1582afb46417ce3772037dbabe2ca6fd2beeb87fc
SHA25609a14b18663c0ea5e3706d91204dd7e1379a45698a956b46ea7c4c0ec62a795b
SHA5125f7e98e5c92382cf820b15d985c4999704d998a3dafa30524675db7a4c5e950854943f11d18d966e7d3a0cb1f20716906b557e7a0fe0dbb5d114fdc67e9d7ae2
-
C:\Users\Admin\AppData\Local\Temp\mitzdyntn.exeFilesize
112KB
MD522714749e5ce66ce2db8b69f0490ecad
SHA1582afb46417ce3772037dbabe2ca6fd2beeb87fc
SHA25609a14b18663c0ea5e3706d91204dd7e1379a45698a956b46ea7c4c0ec62a795b
SHA5125f7e98e5c92382cf820b15d985c4999704d998a3dafa30524675db7a4c5e950854943f11d18d966e7d3a0cb1f20716906b557e7a0fe0dbb5d114fdc67e9d7ae2
-
C:\Users\Admin\AppData\Local\Temp\mitzdyntn.exeFilesize
112KB
MD522714749e5ce66ce2db8b69f0490ecad
SHA1582afb46417ce3772037dbabe2ca6fd2beeb87fc
SHA25609a14b18663c0ea5e3706d91204dd7e1379a45698a956b46ea7c4c0ec62a795b
SHA5125f7e98e5c92382cf820b15d985c4999704d998a3dafa30524675db7a4c5e950854943f11d18d966e7d3a0cb1f20716906b557e7a0fe0dbb5d114fdc67e9d7ae2
-
C:\Users\Admin\AppData\Local\Temp\wadoxpggn.zngFilesize
5KB
MD51b854cc4df1b85317c7f6b12ddcefcab
SHA1c0e68cf12fe1ed7b716a00dea59f7e36f5891fa5
SHA25636706e32792b682edc9a4a8c8f9bec2784b730c9a182ea083f04c78edc31d261
SHA512b7f3f3f39e9af2f717d203a25ae7cd5d66dd3a3e745d51e72ea1b0c0a53946221b0c54fc83e3c89984f99b7fadc22193c92b316eaac5bc8704296f5ad4256024
-
memory/2392-137-0x0000000000000000-mapping.dmp
-
memory/2392-139-0x0000000004A00000-0x0000000004FA4000-memory.dmpFilesize
5.6MB
-
memory/2392-140-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2392-141-0x0000000004FD0000-0x000000000506C000-memory.dmpFilesize
624KB
-
memory/2392-142-0x0000000005990000-0x00000000059F6000-memory.dmpFilesize
408KB
-
memory/2392-143-0x0000000005B60000-0x0000000005BB0000-memory.dmpFilesize
320KB
-
memory/2392-144-0x0000000005D20000-0x0000000005DB2000-memory.dmpFilesize
584KB
-
memory/2392-145-0x0000000005FA0000-0x0000000005FAA000-memory.dmpFilesize
40KB
-
memory/3352-132-0x0000000000000000-mapping.dmp