Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-03-2023 12:44

General

  • Target

    New inquiry - Qingdao Wisdom International Supply Chain Management Co Ltd.exe

  • Size

    794KB

  • MD5

    71cf68e20364b584bb08ea08f2d64b9b

  • SHA1

    60402cf86e50c425e4852ee761c2d7650e76ba56

  • SHA256

    920961f43c4590704b068fb3bd274325c966908e805f7994522ce173e7e4c0ec

  • SHA512

    028d3267066b3da3e8f51fe957e2d6e2a9c71e7d713460e1831f1e3b1f18093d52e1155059aa8e65dc6c8ff8e70077c910d711f1a6222d3f0717130de124392a

  • SSDEEP

    24576:WA5xZDunGsiJgD1iYpOe7A6R90HRYVuAMVn:H57unGsi61iYnMVn

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    vmeee@kopamarine.xyz
  • Password:
    LC%UjBd1badmanSacr@@
  • Email To:
    vmeee@kopamarine.xyz

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New inquiry - Qingdao Wisdom International Supply Chain Management Co Ltd.exe
    "C:\Users\Admin\AppData\Local\Temp\New inquiry - Qingdao Wisdom International Supply Chain Management Co Ltd.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Users\Admin\AppData\Local\Temp\New inquiry - Qingdao Wisdom International Supply Chain Management Co Ltd.exe
      "C:\Users\Admin\AppData\Local\Temp\New inquiry - Qingdao Wisdom International Supply Chain Management Co Ltd.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:4712

Network

  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    136.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    136.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    0.77.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.77.109.52.in-addr.arpa
    IN PTR
    Response
  • 13.89.179.9:443
    322 B
    7
  • 52.152.110.14:443
    260 B
    5
  • 8.238.20.126:80
    322 B
    7
  • 173.223.113.164:443
    322 B
    7
  • 173.223.113.131:80
    322 B
    7
  • 204.79.197.203:80
    322 B
    7
  • 52.152.110.14:443
    260 B
    5
  • 8.238.177.126:80
    322 B
    7
  • 52.152.110.14:443
    260 B
    5
  • 52.152.110.14:443
    260 B
    5
  • 52.152.110.14:443
    260 B
    5
  • 52.152.110.14:443
    260 B
    5
  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    136.32.126.40.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    136.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    0.77.109.52.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    0.77.109.52.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New inquiry - Qingdao Wisdom International Supply Chain Management Co Ltd.exe.log

    Filesize

    1KB

    MD5

    8ec831f3e3a3f77e4a7b9cd32b48384c

    SHA1

    d83f09fd87c5bd86e045873c231c14836e76a05c

    SHA256

    7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

    SHA512

    26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

  • memory/2604-139-0x0000000006890000-0x000000000692C000-memory.dmp

    Filesize

    624KB

  • memory/2604-135-0x0000000004BB0000-0x0000000004C42000-memory.dmp

    Filesize

    584KB

  • memory/2604-136-0x0000000004D40000-0x0000000004D4A000-memory.dmp

    Filesize

    40KB

  • memory/2604-137-0x0000000004B20000-0x0000000004B30000-memory.dmp

    Filesize

    64KB

  • memory/2604-138-0x0000000004B20000-0x0000000004B30000-memory.dmp

    Filesize

    64KB

  • memory/2604-133-0x0000000000120000-0x00000000001EC000-memory.dmp

    Filesize

    816KB

  • memory/2604-134-0x00000000050C0000-0x0000000005664000-memory.dmp

    Filesize

    5.6MB

  • memory/4712-140-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/4712-143-0x00000000053B0000-0x0000000005416000-memory.dmp

    Filesize

    408KB

  • memory/4712-144-0x00000000053A0000-0x00000000053B0000-memory.dmp

    Filesize

    64KB

  • memory/4712-145-0x0000000006700000-0x0000000006750000-memory.dmp

    Filesize

    320KB

  • memory/4712-146-0x0000000006920000-0x0000000006AE2000-memory.dmp

    Filesize

    1.8MB

  • memory/4712-147-0x00000000053A0000-0x00000000053B0000-memory.dmp

    Filesize

    64KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.