Analysis
- max time kernel
150s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20230621-en - resource tags
- submitted
29/06/2023, 04:30
General
- Target 1740c5dae86b5948e6dd0fc2e99534a8.exe
- Size 578KB
- Sample230629-e4tm8sch3t
- SHA256 4ed2a8e2291ca6f9684acf27a278a2667b703af3c4c67f9bc92eeddb6dede245
Malware Config
Extracted
-
Protocol
smtp
-
Host
cp7nl.hyperhost.ua
-
Port
587
-
Username
-
Password
7213575aceACE@#$
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
cp7nl.hyperhost.ua
-
Port
587
-
Username
-
Password
7213575aceACE@#$
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1740c5dae86b5948e6dd0fc2e99534a8.exe"C:\Users\Admin\AppData\Local\Temp\1740c5dae86b5948e6dd0fc2e99534a8.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1740c5dae86b5948e6dd0fc2e99534a8.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1740c5dae86b5948e6dd0fc2e99534a8.exe"C:\Users\Admin\AppData\Local\Temp\1740c5dae86b5948e6dd0fc2e99534a8.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1740c5dae86b5948e6dd0fc2e99534a8.exe"C:\Users\Admin\AppData\Local\Temp\1740c5dae86b5948e6dd0fc2e99534a8.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
1740c5dae86b5948e6dd0fc2e99534a8.exe.log
__PSScriptPolicyTest_sceti11j.rmj.ps1
memory/692-174-0x00000000078E0000-0x00000000078FE000-memory.dmp
memory/692-145-0x0000000005C10000-0x0000000006238000-memory.dmp
memory/692-186-0x0000000007EF0000-0x0000000007F86000-memory.dmp
memory/692-185-0x0000000007CE0000-0x0000000007CEA000-memory.dmp
memory/692-178-0x0000000007C70000-0x0000000007C8A000-memory.dmp
memory/692-177-0x00000000082B0000-0x000000000892A000-memory.dmp
memory/692-188-0x0000000007FB0000-0x0000000007FCA000-memory.dmp
memory/692-143-0x0000000003050000-0x0000000003086000-memory.dmp
memory/692-164-0x0000000070090000-0x00000000700DC000-memory.dmp
memory/692-187-0x0000000007EA0000-0x0000000007EAE000-memory.dmp
memory/692-146-0x0000000005AA0000-0x0000000005AC2000-memory.dmp
memory/692-147-0x0000000005B40000-0x0000000005BA6000-memory.dmp
memory/692-189-0x0000000007F90000-0x0000000007F98000-memory.dmp
memory/692-157-0x00000000055D0000-0x00000000055E0000-memory.dmp
memory/692-163-0x000000007F440000-0x000000007F450000-memory.dmp
memory/692-159-0x00000000055D0000-0x00000000055E0000-memory.dmp
memory/692-160-0x0000000006970000-0x000000000698E000-memory.dmp
memory/692-162-0x0000000007900000-0x0000000007932000-memory.dmp
memory/692-161-0x00000000055D0000-0x00000000055E0000-memory.dmp
memory/2992-158-0x00000000052B0000-0x00000000052C0000-memory.dmp
memory/2992-144-0x00000000051A0000-0x0000000005206000-memory.dmp
memory/2992-175-0x00000000060F0000-0x0000000006140000-memory.dmp
memory/2992-176-0x0000000006310000-0x00000000064D2000-memory.dmp
memory/2992-140-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2992-192-0x00000000052B0000-0x00000000052C0000-memory.dmp
memory/3076-133-0x00000000002D0000-0x0000000000366000-memory.dmp
memory/3076-139-0x000000000A000000-0x000000000A09C000-memory.dmp
memory/3076-138-0x0000000004CE0000-0x0000000004CF0000-memory.dmp
memory/3076-137-0x0000000004CE0000-0x0000000004CF0000-memory.dmp
memory/3076-136-0x0000000004D30000-0x0000000004D3A000-memory.dmp
memory/3076-135-0x0000000004DD0000-0x0000000004E62000-memory.dmp
memory/3076-134-0x0000000005380000-0x0000000005924000-memory.dmp