Analysis

  • max time kernel
    124s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 10:39

General

  • Target

    162cbee9afd2ddf1689ca7a01161c8dd.exe

  • Size

    872KB

  • MD5

    162cbee9afd2ddf1689ca7a01161c8dd

  • SHA1

    11410b599de59f6a683ad631f91f85157d9cf466

  • SHA256

    5ad45e7314fedc92068f3df1d94ea6f97c29f05e62f0e591e38f126223e68a71

  • SHA512

    4e5d815b44cf0e54b71fd0830bfd13803fd1c2436d5a3c093d4e2ab2506f49ba86e2f548435d3658684c04d9ce6f6ca928caa9134f29a52b4920cda51b3db465

  • SSDEEP

    12288:plhF4yh+JCiwcYMEUcygb5wwvk1Hncz+Ga0T/ZTYw6Jsui/bajgcwo:LaJCiwhMg6wcB2+2xT

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Young84@1

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 7 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\162cbee9afd2ddf1689ca7a01161c8dd.exe
    "C:\Users\Admin\AppData\Local\Temp\162cbee9afd2ddf1689ca7a01161c8dd.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2752
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XOUdKROJF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEF20.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2616
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "{path}"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:3016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpEF20.tmp

    Filesize

    1KB

    MD5

    ba634afc31b65b24c50462f5d0c5ff18

    SHA1

    528663b399b6f34a5918a5f21b90ff4e90554011

    SHA256

    5cb57cfc9bcd868f0a9f170c8b6a48370b44e42018571a538efc59d53ef57ac3

    SHA512

    92f6b923984215656465c31d549b8faa53c8265a71a4816bc06462bb57b2d794205dc1f04a7c00f99756039228e65d45974c7972a95ba1ebf84802ccc4376d0d

  • memory/2752-0-0x0000000000350000-0x0000000000430000-memory.dmp

    Filesize

    896KB

  • memory/2752-1-0x0000000074C50000-0x000000007533E000-memory.dmp

    Filesize

    6.9MB

  • memory/2752-2-0x0000000000510000-0x0000000000598000-memory.dmp

    Filesize

    544KB

  • memory/2752-3-0x0000000004B20000-0x0000000004B60000-memory.dmp

    Filesize

    256KB

  • memory/2752-4-0x0000000000430000-0x0000000000438000-memory.dmp

    Filesize

    32KB

  • memory/2752-5-0x0000000074C50000-0x000000007533E000-memory.dmp

    Filesize

    6.9MB

  • memory/2752-6-0x0000000004B20000-0x0000000004B60000-memory.dmp

    Filesize

    256KB

  • memory/2752-7-0x0000000005260000-0x00000000052F8000-memory.dmp

    Filesize

    608KB

  • memory/2752-8-0x0000000004B60000-0x0000000004BB6000-memory.dmp

    Filesize

    344KB

  • memory/2752-22-0x0000000074C50000-0x000000007533E000-memory.dmp

    Filesize

    6.9MB

  • memory/3016-16-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/3016-14-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/3016-17-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/3016-18-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/3016-19-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/3016-21-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/3016-12-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/3016-24-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/3016-25-0x0000000074BD0000-0x00000000752BE000-memory.dmp

    Filesize

    6.9MB

  • memory/3016-26-0x0000000004C60000-0x0000000004CA0000-memory.dmp

    Filesize

    256KB

  • memory/3016-27-0x0000000074BD0000-0x00000000752BE000-memory.dmp

    Filesize

    6.9MB

  • memory/3016-28-0x0000000004C60000-0x0000000004CA0000-memory.dmp

    Filesize

    256KB

  • memory/3016-29-0x0000000004C60000-0x0000000004CA0000-memory.dmp

    Filesize

    256KB