Analysis
-
max time kernel
73s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 12:37
Static task
static1
Behavioral task
behavioral1
Sample
27c159a49e654e3c14a3ceee213d61a3.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
27c159a49e654e3c14a3ceee213d61a3.exe
Resource
win10v2004-20230220-en
General
-
Target
27c159a49e654e3c14a3ceee213d61a3.exe
-
Size
619KB
-
MD5
27c159a49e654e3c14a3ceee213d61a3
-
SHA1
d3b800e97172d89503599ccaf55504943b34fdb1
-
SHA256
9a580a40478fe984f873013902404ec5eec375ffa95035f3d54f66fb6cbacd5a
-
SHA512
dca9b96c7580c1037558adbe2b29bcbbe9a48545b2d6b6c7143cc0d6789fb53db237a548ac5906fff0c03fb642114f5ad89effda47e7a9cbcfcf97ab7ea889ec
-
SSDEEP
12288:IotzLwrgczcf1bNMEO9xMI0B9WWDVaruQBsG:6P21RMhO9WWDXQ
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
qbkcioyfoxstxqax - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
27c159a49e654e3c14a3ceee213d61a3.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 27c159a49e654e3c14a3ceee213d61a3.exe Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 27c159a49e654e3c14a3ceee213d61a3.exe Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 27c159a49e654e3c14a3ceee213d61a3.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
27c159a49e654e3c14a3ceee213d61a3.exedescription pid process target process PID 2588 set thread context of 3276 2588 27c159a49e654e3c14a3ceee213d61a3.exe 27c159a49e654e3c14a3ceee213d61a3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
27c159a49e654e3c14a3ceee213d61a3.exedescription pid process Token: SeDebugPrivilege 3276 27c159a49e654e3c14a3ceee213d61a3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
27c159a49e654e3c14a3ceee213d61a3.exepid process 3276 27c159a49e654e3c14a3ceee213d61a3.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
27c159a49e654e3c14a3ceee213d61a3.exedescription pid process target process PID 2588 wrote to memory of 3276 2588 27c159a49e654e3c14a3ceee213d61a3.exe 27c159a49e654e3c14a3ceee213d61a3.exe PID 2588 wrote to memory of 3276 2588 27c159a49e654e3c14a3ceee213d61a3.exe 27c159a49e654e3c14a3ceee213d61a3.exe PID 2588 wrote to memory of 3276 2588 27c159a49e654e3c14a3ceee213d61a3.exe 27c159a49e654e3c14a3ceee213d61a3.exe PID 2588 wrote to memory of 3276 2588 27c159a49e654e3c14a3ceee213d61a3.exe 27c159a49e654e3c14a3ceee213d61a3.exe PID 2588 wrote to memory of 3276 2588 27c159a49e654e3c14a3ceee213d61a3.exe 27c159a49e654e3c14a3ceee213d61a3.exe PID 2588 wrote to memory of 3276 2588 27c159a49e654e3c14a3ceee213d61a3.exe 27c159a49e654e3c14a3ceee213d61a3.exe PID 2588 wrote to memory of 3276 2588 27c159a49e654e3c14a3ceee213d61a3.exe 27c159a49e654e3c14a3ceee213d61a3.exe PID 2588 wrote to memory of 3276 2588 27c159a49e654e3c14a3ceee213d61a3.exe 27c159a49e654e3c14a3ceee213d61a3.exe -
outlook_office_path 1 IoCs
Processes:
27c159a49e654e3c14a3ceee213d61a3.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 27c159a49e654e3c14a3ceee213d61a3.exe -
outlook_win_path 1 IoCs
Processes:
27c159a49e654e3c14a3ceee213d61a3.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 27c159a49e654e3c14a3ceee213d61a3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27c159a49e654e3c14a3ceee213d61a3.exe"C:\Users\Admin\AppData\Local\Temp\27c159a49e654e3c14a3ceee213d61a3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\27c159a49e654e3c14a3ceee213d61a3.exe"C:\Users\Admin\AppData\Local\Temp\27c159a49e654e3c14a3ceee213d61a3.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:3276
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\27c159a49e654e3c14a3ceee213d61a3.exe.logFilesize
1KB
MD536049bae97bba745c793444373453cb0
SHA1eb6e9a822944e8e207abba1a5e53f0183a1684f1
SHA256839fa1f9725719938ffa24533587b168bae2768f23ac09dccb3ad4ab8ae6abcd
SHA512a6584b7b435afeffb6becfbed82517087030eb23534fa50deecd02330bf36d633ba22e979e36b9c27e35885f9cc1cc9481dadc53cc265be61391e11a7c2c7cdb
-
memory/2588-139-0x00000000072A0000-0x000000000733C000-memory.dmpFilesize
624KB
-
memory/2588-135-0x0000000005890000-0x0000000005922000-memory.dmpFilesize
584KB
-
memory/2588-136-0x0000000005620000-0x0000000005630000-memory.dmpFilesize
64KB
-
memory/2588-137-0x0000000005620000-0x0000000005630000-memory.dmpFilesize
64KB
-
memory/2588-138-0x0000000005620000-0x0000000005630000-memory.dmpFilesize
64KB
-
memory/2588-133-0x0000000000C70000-0x0000000000D10000-memory.dmpFilesize
640KB
-
memory/2588-134-0x0000000005D60000-0x0000000006304000-memory.dmpFilesize
5.6MB
-
memory/3276-140-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3276-143-0x00000000051D0000-0x0000000005236000-memory.dmpFilesize
408KB
-
memory/3276-144-0x00000000051C0000-0x00000000051D0000-memory.dmpFilesize
64KB
-
memory/3276-145-0x00000000064F0000-0x00000000064FA000-memory.dmpFilesize
40KB
-
memory/3276-146-0x0000000006570000-0x00000000065C0000-memory.dmpFilesize
320KB
-
memory/3276-147-0x00000000051C0000-0x00000000051D0000-memory.dmpFilesize
64KB