Analysis
-
max time kernel
116s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2024, 18:56
Static task
static1
Behavioral task
behavioral1
Sample
Scan0020.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Scan0020.exe
Resource
win10v2004-20240226-en
General
-
Target
Scan0020.exe
-
Size
638KB
-
MD5
a2db85fcad3878617112ac3266282587
-
SHA1
57fb3301594c5577e6c39fdb6388883995cf24d6
-
SHA256
f88b736fe32b6e458ce63fb67b8bf0ebf6388e6e35e23bf9bcb46893375115f1
-
SHA512
742b317d09599b21ead1b570ebfdc0dc27197755456090041d56fb2c1e1077ac7f9cbbf77b82d567155db5090acabbae6f8cb1b1692df61ab1439d1cebcc0cbc
-
SSDEEP
12288:KI+asIzXZ9hvqT2dsWA+DMmyA8wyFtySS7WEZ2a6GwIL8XzuH0:flyuR1DMmryDE4g
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
e)cnIdR1
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
resource yara_rule behavioral2/memory/5036-17-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation Scan0020.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Scan0020.exe Key opened \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Scan0020.exe Key opened \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Scan0020.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4980 set thread context of 5036 4980 Scan0020.exe 99 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4256 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4980 Scan0020.exe 4980 Scan0020.exe 5036 Scan0020.exe 5036 Scan0020.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4980 Scan0020.exe Token: SeDebugPrivilege 5036 Scan0020.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4980 wrote to memory of 4256 4980 Scan0020.exe 97 PID 4980 wrote to memory of 4256 4980 Scan0020.exe 97 PID 4980 wrote to memory of 4256 4980 Scan0020.exe 97 PID 4980 wrote to memory of 5036 4980 Scan0020.exe 99 PID 4980 wrote to memory of 5036 4980 Scan0020.exe 99 PID 4980 wrote to memory of 5036 4980 Scan0020.exe 99 PID 4980 wrote to memory of 5036 4980 Scan0020.exe 99 PID 4980 wrote to memory of 5036 4980 Scan0020.exe 99 PID 4980 wrote to memory of 5036 4980 Scan0020.exe 99 PID 4980 wrote to memory of 5036 4980 Scan0020.exe 99 PID 4980 wrote to memory of 5036 4980 Scan0020.exe 99 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Scan0020.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Scan0020.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Scan0020.exe"C:\Users\Admin\AppData\Local\Temp\Scan0020.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bsDYPzuh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB98C.tmp"2⤵
- Creates scheduled task(s)
PID:4256
-
-
C:\Users\Admin\AppData\Local\Temp\Scan0020.exe"C:\Users\Admin\AppData\Local\Temp\Scan0020.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:5036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5fbd5e75bae4e3d2db57a0f9b5ed0df97
SHA1fcb87f79f8748e213d407b78f932f105f04c98e5
SHA256d87a05d026303c360e84bf915b81bea3f8bc81edcb3a53cb1a64d3852f4e9367
SHA512639c3c4d3e57113dda7c980d2f1752579701d5371a3170b5f65a6f21ab427e130b2a3ff226de3fbbea0041be6e476ae98714d4ab75a17e2988fa5974ffa1a803