Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
18/07/2023, 07:25
Static task
static1
Behavioral task
behavioral1
Sample
tmpsizlv9u4.exe
Resource
win7-20230712-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpsizlv9u4.exe
Resource
win10v2004-20230703-en
7 signatures
150 seconds
General
-
Target
tmpsizlv9u4.exe
-
Size
962KB
-
MD5
4cfe2fae86fb8cce535fbd2234b46c82
-
SHA1
6ab470e2699bcd59ce5333343ed4980a6a82ac75
-
SHA256
c79294073204cc9a6fe6ed0559bc939ccca1cd4855603a2b62a480428af7a38e
-
SHA512
1fc2a60ef8cda806e0a7008507654c5cb93759bdb20690e635a5c1cbb63850fb077726db641f914d039e51579cf4e0674b34882d53249eef9175e971769a90c6
-
SSDEEP
24576:9k70TrcfEZKYEs67FIq9Wk95pbSwwp4JtW5Xj/x/+dprPgMPWEOkp:9kQTAfEZqsoFIOX3pbZwp4JtM/x/cYYd
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.mbarieservicesltd.com - Port:
587 - Username:
[email protected] - Password:
*o9H+18Q4%;M - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe Key opened \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe Key opened \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2500 set thread context of 2352 2500 tmpsizlv9u4.exe 28 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2500 tmpsizlv9u4.exe Token: SeDebugPrivilege 2352 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2352 2500 tmpsizlv9u4.exe 28 PID 2500 wrote to memory of 2352 2500 tmpsizlv9u4.exe 28 PID 2500 wrote to memory of 2352 2500 tmpsizlv9u4.exe 28 PID 2500 wrote to memory of 2352 2500 tmpsizlv9u4.exe 28 PID 2500 wrote to memory of 2352 2500 tmpsizlv9u4.exe 28 PID 2500 wrote to memory of 2352 2500 tmpsizlv9u4.exe 28 PID 2500 wrote to memory of 2352 2500 tmpsizlv9u4.exe 28 PID 2500 wrote to memory of 2352 2500 tmpsizlv9u4.exe 28 PID 2500 wrote to memory of 2352 2500 tmpsizlv9u4.exe 28 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpsizlv9u4.exe"C:\Users\Admin\AppData\Local\Temp\tmpsizlv9u4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2352
-