Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2023, 13:38

General

  • Target

    Product Order.exe

  • Size

    776KB

  • MD5

    dc864332ee7a85324d0cda25fac3bf21

  • SHA1

    5be0e586e93b9042f8a72e1c1bb1a5182a4066d3

  • SHA256

    8aead2c3d3796d348dc61029023a5679f2ef747c8ce155a767d5e47280e5ec26

  • SHA512

    f02820ec93fc9f4794e5144986f9defa41a5510c758f43273eb6ad7d0b9ad537ebab5cacc63ea705152eb514572abe345db29406d4a9fabddde6b7cb8ee1e1f1

  • SSDEEP

    24576:KiOV/NOapDl4JebJgUte4/pB18/dBrZNx2JBJ:KiOV/NOapDlpKUM4/po//rZz2JBJ

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6254200827:AAE72ehike93Yl10K-g-eoD9WA3Xk9taVes/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Product Order.exe
    "C:\Users\Admin\AppData\Local\Temp\Product Order.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NNrzPTbykttn.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3476
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NNrzPTbykttn" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB352.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3932
    • C:\Users\Admin\AppData\Local\Temp\Product Order.exe
      "C:\Users\Admin\AppData\Local\Temp\Product Order.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:4564

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Product Order.exe.log

          Filesize

          1KB

          MD5

          33d62ef2c354f839a8b2b987e6ee41e7

          SHA1

          d76f64ac411a61f3f232f7f9f7b179bd34042226

          SHA256

          f6a84062cb11ccf802324692c2c4c48543377cf717d98efd5de695ed6d0a97d9

          SHA512

          d68a426b2f4646bb45e2267d60680166a8effb9a461e5a07756ba13a3bdf36b27e6e9777d945d03a62362e6976e92214c53ffc7c4f03ec28d3fcfc9a442c5e3c

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jh5edumk.dju.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmpB352.tmp

          Filesize

          1KB

          MD5

          9983879da9e852d3420580dcbd057722

          SHA1

          3b573a9e87f470d32d77d70d441b116fa7de4bb7

          SHA256

          ca6f7780e97850874c0e179422bea9054febcedb8f692587319ad44f1fc57560

          SHA512

          cd135df7fd7f24a9b8028b234b6d0d6dc7b49f5eddf5f597cda1a1229a7370e8565cc7d324dfb3dccf2d2377e14c2533a28432a7032e69651026fac75c2fdcef

        • memory/1972-134-0x0000000005190000-0x0000000005734000-memory.dmp

          Filesize

          5.6MB

        • memory/1972-135-0x0000000004C90000-0x0000000004D22000-memory.dmp

          Filesize

          584KB

        • memory/1972-136-0x0000000004D40000-0x0000000004D4A000-memory.dmp

          Filesize

          40KB

        • memory/1972-137-0x0000000004E90000-0x0000000004EA0000-memory.dmp

          Filesize

          64KB

        • memory/1972-138-0x0000000004E90000-0x0000000004EA0000-memory.dmp

          Filesize

          64KB

        • memory/1972-139-0x0000000006940000-0x00000000069DC000-memory.dmp

          Filesize

          624KB

        • memory/1972-133-0x0000000000210000-0x00000000002D8000-memory.dmp

          Filesize

          800KB

        • memory/3476-154-0x0000000005810000-0x0000000005876000-memory.dmp

          Filesize

          408KB

        • memory/3476-167-0x00000000065B0000-0x00000000065E2000-memory.dmp

          Filesize

          200KB

        • memory/3476-150-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

          Filesize

          64KB

        • memory/3476-151-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

          Filesize

          64KB

        • memory/3476-187-0x0000000007610000-0x0000000007618000-memory.dmp

          Filesize

          32KB

        • memory/3476-153-0x0000000005770000-0x0000000005792000-memory.dmp

          Filesize

          136KB

        • memory/3476-146-0x0000000005100000-0x0000000005728000-memory.dmp

          Filesize

          6.2MB

        • memory/3476-144-0x0000000004A40000-0x0000000004A76000-memory.dmp

          Filesize

          216KB

        • memory/3476-186-0x0000000007630000-0x000000000764A000-memory.dmp

          Filesize

          104KB

        • memory/3476-165-0x0000000005FE0000-0x0000000005FFE000-memory.dmp

          Filesize

          120KB

        • memory/3476-166-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

          Filesize

          64KB

        • memory/3476-185-0x0000000007520000-0x000000000752E000-memory.dmp

          Filesize

          56KB

        • memory/3476-168-0x00000000704E0000-0x000000007052C000-memory.dmp

          Filesize

          304KB

        • memory/3476-178-0x0000000006590000-0x00000000065AE000-memory.dmp

          Filesize

          120KB

        • memory/3476-179-0x000000007F800000-0x000000007F810000-memory.dmp

          Filesize

          64KB

        • memory/3476-180-0x0000000007930000-0x0000000007FAA000-memory.dmp

          Filesize

          6.5MB

        • memory/3476-181-0x00000000072E0000-0x00000000072FA000-memory.dmp

          Filesize

          104KB

        • memory/3476-182-0x0000000007350000-0x000000000735A000-memory.dmp

          Filesize

          40KB

        • memory/3476-184-0x0000000007560000-0x00000000075F6000-memory.dmp

          Filesize

          600KB

        • memory/4564-183-0x0000000007010000-0x0000000007060000-memory.dmp

          Filesize

          320KB

        • memory/4564-147-0x0000000000400000-0x0000000000430000-memory.dmp

          Filesize

          192KB

        • memory/4564-164-0x0000000005930000-0x0000000005940000-memory.dmp

          Filesize

          64KB

        • memory/4564-152-0x0000000005870000-0x00000000058D6000-memory.dmp

          Filesize

          408KB

        • memory/4564-190-0x0000000005930000-0x0000000005940000-memory.dmp

          Filesize

          64KB