Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 11:05
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
General
-
Target
tmp.exe
-
Size
455KB
-
MD5
e47210accd809054f50bb4f1c765004e
-
SHA1
a37d125ebe7641fd00addf211083cafe08335f06
-
SHA256
43d66102096b171d791582ce4ad7881c68946594a91fa9c4931e9fae6b70e806
-
SHA512
78a402c688b230fb5fdcdb41de13d5e4b4712be0bc55b71d2275cb6072c0734a3aef172d72088ade88d308b6337c1b928ebea5cfe8079b43dcb0e45775fc0252
-
SSDEEP
12288:ZjXTfWDjZOeitDtLlP547QTbIbjGV3u3Cj3YE2:J7WfZOfllIbjIeScD
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
jsc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsc.exe Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsc.exe Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsc.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 20 api.ipify.org 19 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp.exedescription pid process target process PID 432 set thread context of 3340 432 tmp.exe jsc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
jsc.exedescription pid process Token: SeDebugPrivilege 3340 jsc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
tmp.exedescription pid process target process PID 432 wrote to memory of 3340 432 tmp.exe jsc.exe PID 432 wrote to memory of 3340 432 tmp.exe jsc.exe PID 432 wrote to memory of 3340 432 tmp.exe jsc.exe PID 432 wrote to memory of 3340 432 tmp.exe jsc.exe PID 432 wrote to memory of 3340 432 tmp.exe jsc.exe PID 432 wrote to memory of 3340 432 tmp.exe jsc.exe PID 432 wrote to memory of 3340 432 tmp.exe jsc.exe PID 432 wrote to memory of 3340 432 tmp.exe jsc.exe -
outlook_office_path 1 IoCs
Processes:
jsc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsc.exe -
outlook_win_path 1 IoCs
Processes:
jsc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/432-133-0x000001737E4B0000-0x000001737E526000-memory.dmpFilesize
472KB
-
memory/432-134-0x000001731A610000-0x000001731A620000-memory.dmpFilesize
64KB
-
memory/3340-135-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3340-137-0x00000000059A0000-0x0000000005F44000-memory.dmpFilesize
5.6MB
-
memory/3340-138-0x0000000005350000-0x00000000053B6000-memory.dmpFilesize
408KB
-
memory/3340-139-0x0000000005540000-0x0000000005550000-memory.dmpFilesize
64KB
-
memory/3340-140-0x0000000006F00000-0x0000000006F92000-memory.dmpFilesize
584KB
-
memory/3340-141-0x0000000006EE0000-0x0000000006EEA000-memory.dmpFilesize
40KB
-
memory/3340-142-0x0000000007140000-0x0000000007190000-memory.dmpFilesize
320KB
-
memory/3340-143-0x0000000007360000-0x0000000007522000-memory.dmpFilesize
1.8MB
-
memory/3340-144-0x0000000005540000-0x0000000005550000-memory.dmpFilesize
64KB