Analysis

  • max time kernel
    59s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    15/06/2023, 20:23

General

  • Target

    purchase order (2).exe

  • Size

    743KB

  • MD5

    974fe07d20f86b749e611480053d9a61

  • SHA1

    d5c39fffb6cccae4dd6dc18c7044a96fb7d4506a

  • SHA256

    f3272c1d83abe1c34e604d47d8e7994fc9b9d9914606fe0499fd2feef07cd1cb

  • SHA512

    54e91fd5b813076514b73b2415ebbe269549cccc3a458ae318ab06676abc2bcc74276011e903258bd3fc3bf7c216c5a140cb013ccb9ca7d6c97d4b9c1d7f0bbe

  • SSDEEP

    12288:HM2iNyOe42KMu/N3mWhQmwmJCMpUlOwr1v8+7VfK0AKV6sUj7sMl9vNpyws1KNS2:s1wOV/NOaOOwr1v8yVfKrg6sUjQsZeKZ

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6118510930:AAGLmjz14DOBPW-OuVj-xMJhmBoGJAqv5to/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\purchase order (2).exe
    "C:\Users\Admin\AppData\Local\Temp\purchase order (2).exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\purchase order (2).exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:268
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uXsGLULpXF.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:872
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uXsGLULpXF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD6EF.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1772
    • C:\Users\Admin\AppData\Local\Temp\purchase order (2).exe
      "C:\Users\Admin\AppData\Local\Temp\purchase order (2).exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:1376

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpD6EF.tmp

    Filesize

    1KB

    MD5

    5ce8dc1182a24118d6397aaf2a05fe83

    SHA1

    55217704c72909a7e80173d8d0628eb51214c814

    SHA256

    d93cb424bbc33c0e8e737dfd55d22c8e78c03113c164c1614da87f6705001bfd

    SHA512

    9b93da33af6b29341d70f9ddc6e7ce1ada9f1068d58b83a5568d6a92bf916cb9cbd3276cbbf435da407fbe81f97874b8a5d384a519edc2becc13ad2aae82951c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9DZUFVHCMDZP3JJLPI1I.temp

    Filesize

    7KB

    MD5

    86058d48379ef0e2fc8293e598b45330

    SHA1

    befe425df64e66b8bb0f61f5e75f8474430e4238

    SHA256

    e8e29c63a0a04751c6693f23e41c36c57dd22d5c091f2ff95b4dd2672675c858

    SHA512

    621fae25559c1448b6b7a8bc4657ef8d7a8d283eb22cf8c234ed295946586fde447e7e5772ee712f6772c831f5facf56c8d75c7fb22ada640da5b9b5631a4cf1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    86058d48379ef0e2fc8293e598b45330

    SHA1

    befe425df64e66b8bb0f61f5e75f8474430e4238

    SHA256

    e8e29c63a0a04751c6693f23e41c36c57dd22d5c091f2ff95b4dd2672675c858

    SHA512

    621fae25559c1448b6b7a8bc4657ef8d7a8d283eb22cf8c234ed295946586fde447e7e5772ee712f6772c831f5facf56c8d75c7fb22ada640da5b9b5631a4cf1

  • memory/268-83-0x0000000002490000-0x00000000024D0000-memory.dmp

    Filesize

    256KB

  • memory/872-84-0x0000000002670000-0x00000000026B0000-memory.dmp

    Filesize

    256KB

  • memory/1376-75-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/1376-77-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1376-82-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/1376-80-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/1376-78-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/1376-73-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/1376-74-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/1376-76-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2004-72-0x0000000004DC0000-0x0000000004DF4000-memory.dmp

    Filesize

    208KB

  • memory/2004-59-0x0000000005F70000-0x0000000005FDC000-memory.dmp

    Filesize

    432KB

  • memory/2004-54-0x0000000001120000-0x00000000011E0000-memory.dmp

    Filesize

    768KB

  • memory/2004-57-0x0000000004980000-0x00000000049C0000-memory.dmp

    Filesize

    256KB

  • memory/2004-58-0x00000000002B0000-0x00000000002BC000-memory.dmp

    Filesize

    48KB

  • memory/2004-56-0x0000000000650000-0x0000000000662000-memory.dmp

    Filesize

    72KB

  • memory/2004-55-0x0000000004980000-0x00000000049C0000-memory.dmp

    Filesize

    256KB