Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-06-2024 12:49

General

  • Target

    Order_doc_3898934784389932787823637832893278.exe

  • Size

    73KB

  • MD5

    7f9f6856748008e47c736664df0f97d4

  • SHA1

    6be6218294e24d5515e09c019656a8c0cf34100e

  • SHA256

    040a600783e2b014cd6b8163e36611d2af9a7246d70d34b9b32ab23ab4691605

  • SHA512

    fa8c2312eb905528f90e54e38e45997dcf0013ce891542bb7d1c38ed584b78aa0b1d335276271fddd2d750ae8abfbb80fcc03d90fa331c9f32cf8ecde8851cac

  • SSDEEP

    1536:RJbGquvrQcdCIdTaqc3aBMohSqdXnbCu81nFS8mO:RVGPrQWCIEqBBRhSqdXbCu81JmO

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Order_doc_3898934784389932787823637832893278.exe
    "C:\Users\Admin\AppData\Local\Temp\Order_doc_3898934784389932787823637832893278.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Order_doc_3898934784389932787823637832893278" /t REG_SZ /F /D "C:\Users\Admin\Documents\Order_doc_3898934784389932787823637832893278.pif"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1680
      • C:\Windows\SysWOW64\reg.exe
        REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Order_doc_3898934784389932787823637832893278" /t REG_SZ /F /D "C:\Users\Admin\Documents\Order_doc_3898934784389932787823637832893278.pif"
        3⤵
        • Adds Run key to start application
        PID:4064
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c Copy "C:\Users\Admin\AppData\Local\Temp\Order_doc_3898934784389932787823637832893278.exe" "C:\Users\Admin\Documents\Order_doc_3898934784389932787823637832893278.pif"
      2⤵
        PID:5108
      • C:\Users\Admin\AppData\Local\Temp\Order_doc_3898934784389932787823637832893278.exe
        "C:\Users\Admin\AppData\Local\Temp\Order_doc_3898934784389932787823637832893278.exe"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:1796

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Order_doc_3898934784389932787823637832893278.exe.log

      Filesize

      1KB

      MD5

      4c10a5eaaf85cae65babcfe042c593c1

      SHA1

      c45e31383af7647ca9c91278f8da01c6c162d4c6

      SHA256

      fd7489a2b570407233112592b97c3e89f55a6e7ec51d8a303918f3582c6a0305

      SHA512

      7dccb1ea8cd47d290e1afd19233488473e7a270ae912a750f4a89458b2315cd77440c35b2534b7261e6605bf39f15510111e8c5d8d87ad82a94da658112e9c1c

    • memory/1796-15-0x0000000005B50000-0x0000000005BA0000-memory.dmp

      Filesize

      320KB

    • memory/1796-9-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/1796-18-0x0000000075030000-0x00000000757E0000-memory.dmp

      Filesize

      7.7MB

    • memory/1796-17-0x0000000006290000-0x000000000629A000-memory.dmp

      Filesize

      40KB

    • memory/1796-16-0x00000000062F0000-0x0000000006382000-memory.dmp

      Filesize

      584KB

    • memory/1796-14-0x0000000075030000-0x00000000757E0000-memory.dmp

      Filesize

      7.7MB

    • memory/1796-13-0x0000000075030000-0x00000000757E0000-memory.dmp

      Filesize

      7.7MB

    • memory/2896-5-0x0000000005960000-0x00000000059FC000-memory.dmp

      Filesize

      624KB

    • memory/2896-12-0x0000000075030000-0x00000000757E0000-memory.dmp

      Filesize

      7.7MB

    • memory/2896-2-0x0000000075030000-0x00000000757E0000-memory.dmp

      Filesize

      7.7MB

    • memory/2896-6-0x0000000005A00000-0x0000000005A66000-memory.dmp

      Filesize

      408KB

    • memory/2896-0-0x000000007503E000-0x000000007503F000-memory.dmp

      Filesize

      4KB

    • memory/2896-1-0x0000000000340000-0x0000000000358000-memory.dmp

      Filesize

      96KB

    • memory/2896-4-0x0000000005E20000-0x00000000063C4000-memory.dmp

      Filesize

      5.6MB

    • memory/2896-3-0x0000000005700000-0x000000000576E000-memory.dmp

      Filesize

      440KB