Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2023, 09:24

General

  • Target

    PURCHASE ORDER.exe

  • Size

    271KB

  • MD5

    664fc03c56695b1fe1cfa34159cc36dd

  • SHA1

    f9dd1ebc4f3d60c7c7400c8d1b67164a0e3f98a2

  • SHA256

    156c6d57b228e6b5a8920f268f26b70b5fb6ec53b255f102f2dc9f7fa21c9097

  • SHA512

    b52a6332e7abf43747ea2aa64173efeecbf7bcae3935e56563d949c12bef50f2b7d75a30a8147bdcaa676e945ccb31e04dc89fe1c736d92a77588540834709f9

  • SSDEEP

    6144:vYa6coraik7e/kTz9pRPAwpm4Fb3P7c9Vb0mH3a64x:vYa63JsTvRPAwpm4V3DSVA8aR

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
    "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3100
    • C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
      "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:4696

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsn418F.tmp\udflbqvv.dll

    Filesize

    22KB

    MD5

    435d3422a664d8aa605c24f1bf6bb51b

    SHA1

    640ff0c721dadb2b3be1f5e99628c23545f171a9

    SHA256

    b245f1d5ae9a1c264d54c148b8c566d710bd2a990ea53df5489c8a3d83ffe091

    SHA512

    ff3d1f8510683b5191bb539cbf530d849545c349f3ea697494a7f34d7a20fc8f15178fa789e27dc3a337b32aac777024869215c952833efd477ad9f15002cbf8

  • memory/3100-139-0x00000000022F0000-0x00000000022F2000-memory.dmp

    Filesize

    8KB

  • memory/4696-140-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/4696-141-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/4696-142-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/4696-143-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/4696-144-0x0000000004A90000-0x0000000004AA0000-memory.dmp

    Filesize

    64KB

  • memory/4696-145-0x0000000004AA0000-0x0000000005044000-memory.dmp

    Filesize

    5.6MB

  • memory/4696-146-0x00000000049F0000-0x0000000004A56000-memory.dmp

    Filesize

    408KB

  • memory/4696-148-0x0000000004A90000-0x0000000004AA0000-memory.dmp

    Filesize

    64KB

  • memory/4696-149-0x0000000004A90000-0x0000000004AA0000-memory.dmp

    Filesize

    64KB

  • memory/4696-150-0x0000000004A90000-0x0000000004AA0000-memory.dmp

    Filesize

    64KB

  • memory/4696-151-0x0000000005B90000-0x0000000005BE0000-memory.dmp

    Filesize

    320KB

  • memory/4696-152-0x0000000005BE0000-0x0000000005DA2000-memory.dmp

    Filesize

    1.8MB

  • memory/4696-153-0x0000000005DC0000-0x0000000005E52000-memory.dmp

    Filesize

    584KB

  • memory/4696-154-0x0000000005FC0000-0x0000000005FCA000-memory.dmp

    Filesize

    40KB