Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15-09-2024 02:07
Static task
static1
Behavioral task
behavioral1
Sample
a75213bdbb2472198c5f095350570610N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a75213bdbb2472198c5f095350570610N.exe
Resource
win10v2004-20240802-en
General
-
Target
a75213bdbb2472198c5f095350570610N.exe
-
Size
1.1MB
-
MD5
a75213bdbb2472198c5f095350570610
-
SHA1
c1ee6182bb849b341399114dec39988a93dd566e
-
SHA256
f4b3ef438899f2fafa54940da7f9255d6ef762f052015bba809e339400e73691
-
SHA512
2b3e2396d2ee434b18c405719b421c394e68575cc02e6d46258977d1494edb9df5a9d92478a77515bc3454f783542dcbc15d785d314dad17c45c633c4ae309d5
-
SSDEEP
24576:G4lavt0LkLL9IMixoEgeaN5Hk/mdYpxRbfUCq9MmCS:Rkwkn9IMHeaNa/mwxNaPCS
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3276 set thread context of 1632 3276 a75213bdbb2472198c5f095350570610N.exe 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a75213bdbb2472198c5f095350570610N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3276 a75213bdbb2472198c5f095350570610N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1632 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3276 a75213bdbb2472198c5f095350570610N.exe 3276 a75213bdbb2472198c5f095350570610N.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3276 a75213bdbb2472198c5f095350570610N.exe 3276 a75213bdbb2472198c5f095350570610N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3276 wrote to memory of 1632 3276 a75213bdbb2472198c5f095350570610N.exe 86 PID 3276 wrote to memory of 1632 3276 a75213bdbb2472198c5f095350570610N.exe 86 PID 3276 wrote to memory of 1632 3276 a75213bdbb2472198c5f095350570610N.exe 86 PID 3276 wrote to memory of 1632 3276 a75213bdbb2472198c5f095350570610N.exe 86 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a75213bdbb2472198c5f095350570610N.exe"C:\Users\Admin\AppData\Local\Temp\a75213bdbb2472198c5f095350570610N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\a75213bdbb2472198c5f095350570610N.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
260KB
MD5f05ccb7cc5e93999c508fb8a1e96da3b
SHA120b81db0e9ff8f72b520418593e8d04497937045
SHA256d5daa7be64c5e81d4aa9bf49eed19b4202fd9a879d0a4f6353a4f7d57e3b137e
SHA512b555d6216cd31eea421d127d5bbdb152764d5e090a102e637063df6671570ad703faca73ae3c6d66ab92e7fcac3eb596fac30953ebb723177a2e3ab5857c8771