Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-06-2024 12:49
Static task
static1
Behavioral task
behavioral1
Sample
Order_doc_3898934784389932787823637832893278.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Order_doc_3898934784389932787823637832893278.exe
Resource
win10v2004-20240508-en
General
-
Target
Order_doc_3898934784389932787823637832893278.exe
-
Size
73KB
-
MD5
7f9f6856748008e47c736664df0f97d4
-
SHA1
6be6218294e24d5515e09c019656a8c0cf34100e
-
SHA256
040a600783e2b014cd6b8163e36611d2af9a7246d70d34b9b32ab23ab4691605
-
SHA512
fa8c2312eb905528f90e54e38e45997dcf0013ce891542bb7d1c38ed584b78aa0b1d335276271fddd2d750ae8abfbb80fcc03d90fa331c9f32cf8ecde8851cac
-
SSDEEP
1536:RJbGquvrQcdCIdTaqc3aBMohSqdXnbCu81nFS8mO:RVGPrQWCIEqBBRhSqdXbCu81JmO
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.hypos-care.com - Port:
587 - Username:
[email protected] - Password:
$zg$gUa2 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Order_doc_3898934784389932787823637832893278.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order_doc_3898934784389932787823637832893278.exe Key opened \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order_doc_3898934784389932787823637832893278.exe Key opened \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order_doc_3898934784389932787823637832893278.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Order_doc_3898934784389932787823637832893278 = "C:\\Users\\Admin\\Documents\\Order_doc_3898934784389932787823637832893278.pif" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order_doc_3898934784389932787823637832893278.exedescription pid process target process PID 2896 set thread context of 1796 2896 Order_doc_3898934784389932787823637832893278.exe Order_doc_3898934784389932787823637832893278.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
Order_doc_3898934784389932787823637832893278.exeOrder_doc_3898934784389932787823637832893278.exepid process 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 2896 Order_doc_3898934784389932787823637832893278.exe 1796 Order_doc_3898934784389932787823637832893278.exe 1796 Order_doc_3898934784389932787823637832893278.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order_doc_3898934784389932787823637832893278.exeOrder_doc_3898934784389932787823637832893278.exedescription pid process Token: SeDebugPrivilege 2896 Order_doc_3898934784389932787823637832893278.exe Token: SeDebugPrivilege 1796 Order_doc_3898934784389932787823637832893278.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Order_doc_3898934784389932787823637832893278.execmd.exedescription pid process target process PID 2896 wrote to memory of 1680 2896 Order_doc_3898934784389932787823637832893278.exe cmd.exe PID 2896 wrote to memory of 1680 2896 Order_doc_3898934784389932787823637832893278.exe cmd.exe PID 2896 wrote to memory of 1680 2896 Order_doc_3898934784389932787823637832893278.exe cmd.exe PID 1680 wrote to memory of 4064 1680 cmd.exe reg.exe PID 1680 wrote to memory of 4064 1680 cmd.exe reg.exe PID 1680 wrote to memory of 4064 1680 cmd.exe reg.exe PID 2896 wrote to memory of 5108 2896 Order_doc_3898934784389932787823637832893278.exe cmd.exe PID 2896 wrote to memory of 5108 2896 Order_doc_3898934784389932787823637832893278.exe cmd.exe PID 2896 wrote to memory of 5108 2896 Order_doc_3898934784389932787823637832893278.exe cmd.exe PID 2896 wrote to memory of 1796 2896 Order_doc_3898934784389932787823637832893278.exe Order_doc_3898934784389932787823637832893278.exe PID 2896 wrote to memory of 1796 2896 Order_doc_3898934784389932787823637832893278.exe Order_doc_3898934784389932787823637832893278.exe PID 2896 wrote to memory of 1796 2896 Order_doc_3898934784389932787823637832893278.exe Order_doc_3898934784389932787823637832893278.exe PID 2896 wrote to memory of 1796 2896 Order_doc_3898934784389932787823637832893278.exe Order_doc_3898934784389932787823637832893278.exe PID 2896 wrote to memory of 1796 2896 Order_doc_3898934784389932787823637832893278.exe Order_doc_3898934784389932787823637832893278.exe PID 2896 wrote to memory of 1796 2896 Order_doc_3898934784389932787823637832893278.exe Order_doc_3898934784389932787823637832893278.exe PID 2896 wrote to memory of 1796 2896 Order_doc_3898934784389932787823637832893278.exe Order_doc_3898934784389932787823637832893278.exe PID 2896 wrote to memory of 1796 2896 Order_doc_3898934784389932787823637832893278.exe Order_doc_3898934784389932787823637832893278.exe -
outlook_office_path 1 IoCs
Processes:
Order_doc_3898934784389932787823637832893278.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order_doc_3898934784389932787823637832893278.exe -
outlook_win_path 1 IoCs
Processes:
Order_doc_3898934784389932787823637832893278.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Order_doc_3898934784389932787823637832893278.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order_doc_3898934784389932787823637832893278.exe"C:\Users\Admin\AppData\Local\Temp\Order_doc_3898934784389932787823637832893278.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Order_doc_3898934784389932787823637832893278" /t REG_SZ /F /D "C:\Users\Admin\Documents\Order_doc_3898934784389932787823637832893278.pif"2⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Order_doc_3898934784389932787823637832893278" /t REG_SZ /F /D "C:\Users\Admin\Documents\Order_doc_3898934784389932787823637832893278.pif"3⤵
- Adds Run key to start application
PID:4064
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c Copy "C:\Users\Admin\AppData\Local\Temp\Order_doc_3898934784389932787823637832893278.exe" "C:\Users\Admin\Documents\Order_doc_3898934784389932787823637832893278.pif"2⤵PID:5108
-
-
C:\Users\Admin\AppData\Local\Temp\Order_doc_3898934784389932787823637832893278.exe"C:\Users\Admin\AppData\Local\Temp\Order_doc_3898934784389932787823637832893278.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1796
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Order_doc_3898934784389932787823637832893278.exe.log
Filesize1KB
MD54c10a5eaaf85cae65babcfe042c593c1
SHA1c45e31383af7647ca9c91278f8da01c6c162d4c6
SHA256fd7489a2b570407233112592b97c3e89f55a6e7ec51d8a303918f3582c6a0305
SHA5127dccb1ea8cd47d290e1afd19233488473e7a270ae912a750f4a89458b2315cd77440c35b2534b7261e6605bf39f15510111e8c5d8d87ad82a94da658112e9c1c