Resubmissions

24-07-2023 06:32

230724-haylwaag65 10

16-07-2023 18:15

230716-wwbacshb7z 10

Analysis

  • max time kernel
    136s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2023 06:32

General

  • Target

    1ee2d1e645387a169bdc6a904e47b6a2546e4d34546733b4aedb7bb22371f90a.exe

  • Size

    369KB

  • MD5

    9b9299a298cd430f1e542bac8c4ffb57

  • SHA1

    835f1b99fa84f225dc0f45c2f70357422389346c

  • SHA256

    1ee2d1e645387a169bdc6a904e47b6a2546e4d34546733b4aedb7bb22371f90a

  • SHA512

    c70a79c2cabd0ec2dbf670b8d0d9675fb197b80ab2b22f6cd7fc9b4339980cfc0f2873459c84ce7ee551005fee0af33b97e659f5f09b8b7bc2122bf6b8eef365

  • SSDEEP

    6144:vBSqCcN/gMjjHnfVS/mnH5P4qrJCvNSu0MomGsUs6fcsXh5C/Br3osvnP:5SbciM3fVDPP8Nw6BWcsXO3osvP

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.urban.co.th
  • Port:
    587
  • Username:
    info@urban.co.th
  • Password:
    Urban@1143

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ee2d1e645387a169bdc6a904e47b6a2546e4d34546733b4aedb7bb22371f90a.exe
    "C:\Users\Admin\AppData\Local\Temp\1ee2d1e645387a169bdc6a904e47b6a2546e4d34546733b4aedb7bb22371f90a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:3000

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1036-141-0x0000000008270000-0x000000000830C000-memory.dmp
    Filesize

    624KB

  • memory/1036-144-0x00000000748E0000-0x0000000075090000-memory.dmp
    Filesize

    7MB

  • memory/1036-133-0x0000000000E00000-0x0000000000E62000-memory.dmp
    Filesize

    392KB

  • memory/1036-136-0x0000000005740000-0x00000000057D2000-memory.dmp
    Filesize

    584KB

  • memory/1036-137-0x00000000058C0000-0x00000000058D0000-memory.dmp
    Filesize

    64KB

  • memory/1036-138-0x0000000005730000-0x000000000573A000-memory.dmp
    Filesize

    40KB

  • memory/1036-139-0x00000000748E0000-0x0000000075090000-memory.dmp
    Filesize

    7MB

  • memory/1036-140-0x00000000058C0000-0x00000000058D0000-memory.dmp
    Filesize

    64KB

  • memory/1036-135-0x0000000005C50000-0x00000000061F4000-memory.dmp
    Filesize

    5MB

  • memory/1036-134-0x00000000748E0000-0x0000000075090000-memory.dmp
    Filesize

    7MB

  • memory/3000-152-0x0000000005890000-0x00000000058A0000-memory.dmp
    Filesize

    64KB

  • memory/3000-145-0x00000000748E0000-0x0000000075090000-memory.dmp
    Filesize

    7MB

  • memory/3000-146-0x0000000005890000-0x00000000058A0000-memory.dmp
    Filesize

    64KB

  • memory/3000-147-0x00000000748E0000-0x0000000075090000-memory.dmp
    Filesize

    7MB

  • memory/3000-148-0x0000000005890000-0x00000000058A0000-memory.dmp
    Filesize

    64KB

  • memory/3000-149-0x0000000006630000-0x0000000006696000-memory.dmp
    Filesize

    408KB

  • memory/3000-150-0x0000000006D30000-0x0000000006D80000-memory.dmp
    Filesize

    320KB

  • memory/3000-151-0x0000000005890000-0x00000000058A0000-memory.dmp
    Filesize

    64KB

  • memory/3000-142-0x0000000000400000-0x000000000044C000-memory.dmp
    Filesize

    304KB