Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/03/2023, 10:03

General

  • Target

    6b6b85844a881ca03a5b863660a18a9085714135b0bc25c5db9db98ab5a0cc32.exe

  • Size

    881KB

  • MD5

    9323f6766a811d050994e2b7b257ed15

  • SHA1

    08164a5234d1ae8cee32c6ce2de87eeeadf370e5

  • SHA256

    6b6b85844a881ca03a5b863660a18a9085714135b0bc25c5db9db98ab5a0cc32

  • SHA512

    67f7b3369bd4cc11c7fdecdcf476ecf21eba2d344dad46885800dbfec6a30058a527b9d3a79fa8154be375815f59c8020082f4901c8f87fd1977c89c2b589458

  • SSDEEP

    12288:LtqcgTfx4QRBzk4VKk5k5PESZ/Yb0WH76ZNJwcedWtDS8kdm4S:Ltq3ZTkBSK8SxjXZNJwceAtOTdm

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5485592061:AAFXLAJZi00wLSmwdnQ11cTy0wiGRMBvIbc/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6b6b85844a881ca03a5b863660a18a9085714135b0bc25c5db9db98ab5a0cc32.exe
    "C:\Users\Admin\AppData\Local\Temp\6b6b85844a881ca03a5b863660a18a9085714135b0bc25c5db9db98ab5a0cc32.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oEgQjYzx.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4168
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oEgQjYzx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1B96.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1280
    • C:\Users\Admin\AppData\Local\Temp\6b6b85844a881ca03a5b863660a18a9085714135b0bc25c5db9db98ab5a0cc32.exe
      "C:\Users\Admin\AppData\Local\Temp\6b6b85844a881ca03a5b863660a18a9085714135b0bc25c5db9db98ab5a0cc32.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:3760

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u1wyrhq1.xhe.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmp1B96.tmp

          Filesize

          1KB

          MD5

          ee36d4d255fc5b26cf75270fbc837402

          SHA1

          164ad6a3843d867dc874b823b5d5478306c41849

          SHA256

          ffb77120a00a94e2243d9f74ddc2cf12c2a5fc7ec24a333526fe95101c3e6cf7

          SHA512

          ed8ffb9a91f0b31dce672c714f7c9a5a4b88a6c99c98a51bf5a378716d935828f576eeeae9de7bb73f19b5702c299b5e171eb6a1520df04084815c6285ba6dfc

        • memory/1944-133-0x0000000000CA0000-0x0000000000D82000-memory.dmp

          Filesize

          904KB

        • memory/1944-136-0x00000000056C0000-0x00000000056D0000-memory.dmp

          Filesize

          64KB

        • memory/1944-137-0x00000000058F0000-0x00000000058FA000-memory.dmp

          Filesize

          40KB

        • memory/1944-138-0x00000000056C0000-0x00000000056D0000-memory.dmp

          Filesize

          64KB

        • memory/1944-139-0x00000000084E0000-0x000000000857C000-memory.dmp

          Filesize

          624KB

        • memory/1944-134-0x0000000005D10000-0x00000000062B4000-memory.dmp

          Filesize

          5.6MB

        • memory/1944-135-0x0000000005760000-0x00000000057F2000-memory.dmp

          Filesize

          584KB

        • memory/3760-196-0x0000000005710000-0x0000000005720000-memory.dmp

          Filesize

          64KB

        • memory/3760-184-0x00000000076A0000-0x0000000007862000-memory.dmp

          Filesize

          1.8MB

        • memory/3760-183-0x0000000007400000-0x0000000007450000-memory.dmp

          Filesize

          320KB

        • memory/3760-148-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/3760-164-0x0000000005710000-0x0000000005720000-memory.dmp

          Filesize

          64KB

        • memory/3760-151-0x0000000005620000-0x0000000005686000-memory.dmp

          Filesize

          408KB

        • memory/4168-147-0x0000000004950000-0x0000000004960000-memory.dmp

          Filesize

          64KB

        • memory/4168-179-0x00000000070A0000-0x00000000070BA000-memory.dmp

          Filesize

          104KB

        • memory/4168-152-0x0000000004D70000-0x0000000004D92000-memory.dmp

          Filesize

          136KB

        • memory/4168-149-0x0000000004950000-0x0000000004960000-memory.dmp

          Filesize

          64KB

        • memory/4168-163-0x0000000005D20000-0x0000000005D3E000-memory.dmp

          Filesize

          120KB

        • memory/4168-166-0x0000000006F50000-0x0000000006F82000-memory.dmp

          Filesize

          200KB

        • memory/4168-167-0x0000000070D60000-0x0000000070DAC000-memory.dmp

          Filesize

          304KB

        • memory/4168-177-0x0000000006350000-0x000000000636E000-memory.dmp

          Filesize

          120KB

        • memory/4168-178-0x00000000076E0000-0x0000000007D5A000-memory.dmp

          Filesize

          6.5MB

        • memory/4168-153-0x0000000004F10000-0x0000000004F76000-memory.dmp

          Filesize

          408KB

        • memory/4168-180-0x000000007FB50000-0x000000007FB60000-memory.dmp

          Filesize

          64KB

        • memory/4168-181-0x0000000007110000-0x000000000711A000-memory.dmp

          Filesize

          40KB

        • memory/4168-182-0x0000000007320000-0x00000000073B6000-memory.dmp

          Filesize

          600KB

        • memory/4168-165-0x0000000004950000-0x0000000004960000-memory.dmp

          Filesize

          64KB

        • memory/4168-146-0x0000000004F90000-0x00000000055B8000-memory.dmp

          Filesize

          6.2MB

        • memory/4168-191-0x00000000072D0000-0x00000000072DE000-memory.dmp

          Filesize

          56KB

        • memory/4168-192-0x00000000073E0000-0x00000000073FA000-memory.dmp

          Filesize

          104KB

        • memory/4168-193-0x00000000073C0000-0x00000000073C8000-memory.dmp

          Filesize

          32KB

        • memory/4168-144-0x0000000002410000-0x0000000002446000-memory.dmp

          Filesize

          216KB