Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2023 09:22
Static task
static1
Behavioral task
behavioral1
Sample
LAM CHUAN.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
LAM CHUAN.exe
Resource
win10v2004-20231130-en
General
-
Target
LAM CHUAN.exe
-
Size
739KB
-
MD5
c74873ebdfa9adb3a07c72fedd70ed5c
-
SHA1
67a322f8f715f8d5e347efeb5fa25efd98a7b229
-
SHA256
497bf18f3fcb0080d21c8f9a98a054bdbcfb7da1fe1c93a28bfdb8b84560b10a
-
SHA512
9cd7f335c8d217581d134f8aba3c1f806b2a6a080070137e50b7ffee567e485b3233a58853ebebd748fc263d69d9400597fea523cfbb7f7221cbd5e4cd9b2951
-
SSDEEP
12288:5WBCMtW8G34/uK45+po2aWRl2w63HyYNMpWAOgaNn6b+sZJzHh+gekeFqm6y:ii34/up+pJ3lj63HDNEWAOgen6isZ1He
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
NX@@OLDdollarDV8FW7 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
LAM CHUAN.exedescription pid process target process PID 2396 set thread context of 1192 2396 LAM CHUAN.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 1192 RegSvcs.exe 1192 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1192 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
LAM CHUAN.exedescription pid process target process PID 2396 wrote to memory of 1192 2396 LAM CHUAN.exe RegSvcs.exe PID 2396 wrote to memory of 1192 2396 LAM CHUAN.exe RegSvcs.exe PID 2396 wrote to memory of 1192 2396 LAM CHUAN.exe RegSvcs.exe PID 2396 wrote to memory of 1192 2396 LAM CHUAN.exe RegSvcs.exe PID 2396 wrote to memory of 1192 2396 LAM CHUAN.exe RegSvcs.exe PID 2396 wrote to memory of 1192 2396 LAM CHUAN.exe RegSvcs.exe PID 2396 wrote to memory of 1192 2396 LAM CHUAN.exe RegSvcs.exe PID 2396 wrote to memory of 1192 2396 LAM CHUAN.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LAM CHUAN.exe"C:\Users\Admin\AppData\Local\Temp\LAM CHUAN.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1192