Analysis
-
max time kernel
125s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
03/04/2024, 18:56
Static task
static1
Behavioral task
behavioral1
Sample
Scan0020.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Scan0020.exe
Resource
win10v2004-20240226-en
General
-
Target
Scan0020.exe
-
Size
638KB
-
MD5
a2db85fcad3878617112ac3266282587
-
SHA1
57fb3301594c5577e6c39fdb6388883995cf24d6
-
SHA256
f88b736fe32b6e458ce63fb67b8bf0ebf6388e6e35e23bf9bcb46893375115f1
-
SHA512
742b317d09599b21ead1b570ebfdc0dc27197755456090041d56fb2c1e1077ac7f9cbbf77b82d567155db5090acabbae6f8cb1b1692df61ab1439d1cebcc0cbc
-
SSDEEP
12288:KI+asIzXZ9hvqT2dsWA+DMmyA8wyFtySS7WEZ2a6GwIL8XzuH0:flyuR1DMmryDE4g
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
e)cnIdR1
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 5 IoCs
resource yara_rule behavioral1/memory/2732-16-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/2732-26-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/2732-24-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/2732-22-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/2732-18-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Scan0020.exe Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Scan0020.exe Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Scan0020.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1640 set thread context of 2732 1640 Scan0020.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2744 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1640 Scan0020.exe 1640 Scan0020.exe 2732 Scan0020.exe 2732 Scan0020.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1640 Scan0020.exe Token: SeDebugPrivilege 2732 Scan0020.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2744 1640 Scan0020.exe 28 PID 1640 wrote to memory of 2744 1640 Scan0020.exe 28 PID 1640 wrote to memory of 2744 1640 Scan0020.exe 28 PID 1640 wrote to memory of 2744 1640 Scan0020.exe 28 PID 1640 wrote to memory of 2732 1640 Scan0020.exe 30 PID 1640 wrote to memory of 2732 1640 Scan0020.exe 30 PID 1640 wrote to memory of 2732 1640 Scan0020.exe 30 PID 1640 wrote to memory of 2732 1640 Scan0020.exe 30 PID 1640 wrote to memory of 2732 1640 Scan0020.exe 30 PID 1640 wrote to memory of 2732 1640 Scan0020.exe 30 PID 1640 wrote to memory of 2732 1640 Scan0020.exe 30 PID 1640 wrote to memory of 2732 1640 Scan0020.exe 30 PID 1640 wrote to memory of 2732 1640 Scan0020.exe 30 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Scan0020.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Scan0020.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Scan0020.exe"C:\Users\Admin\AppData\Local\Temp\Scan0020.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bsDYPzuh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA65D.tmp"2⤵
- Creates scheduled task(s)
PID:2744
-
-
C:\Users\Admin\AppData\Local\Temp\Scan0020.exe"C:\Users\Admin\AppData\Local\Temp\Scan0020.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2732
-