Analysis
-
max time kernel
142s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2023, 10:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PI.exe
Resource
win7-20230712-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
PI.exe
Resource
win10v2004-20230703-en
10 signatures
150 seconds
General
-
Target
PI.exe
-
Size
17KB
-
MD5
2774a0b622e8bfbd6a4b339234fc6289
-
SHA1
28a7cfc0d6241b14e3de62fd50ffa7ba564a8574
-
SHA256
c8db380ca07d006181dfa5dfa774c52a97b03688af074b796f3e4da284e8a4bd
-
SHA512
e0cab916cdbad44cc4983393b10bfd4460dbec25c2f5313d9f0ad9ff79348e2de6adcdfeed9c1f20045a5567ad78036da84b1403c683410a5865428f1d7bc65f
-
SSDEEP
384:nxHgkRUx0kbAdkT6uUbHf+dqq+X1cnbIOa6Lk/FaLsKau6:xW0GAdkT6PFqHIfKR6
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.sirisexpress.com - Port:
587 - Username:
[email protected] - Password:
SirisEmails@123 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dalezyzgxp = "C:\\Users\\Admin\\AppData\\Roaming\\Dalezyzgxp.exe" PI.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 30 api.ipify.org 31 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5032 set thread context of 888 5032 PI.exe 88 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 888 MSBuild.exe 888 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5032 PI.exe Token: SeDebugPrivilege 888 MSBuild.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5032 wrote to memory of 888 5032 PI.exe 88 PID 5032 wrote to memory of 888 5032 PI.exe 88 PID 5032 wrote to memory of 888 5032 PI.exe 88 PID 5032 wrote to memory of 888 5032 PI.exe 88 PID 5032 wrote to memory of 888 5032 PI.exe 88 PID 5032 wrote to memory of 888 5032 PI.exe 88 PID 5032 wrote to memory of 888 5032 PI.exe 88 PID 5032 wrote to memory of 888 5032 PI.exe 88 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:888
-