Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-09-2024 08:14

General

  • Target

    Quotation#[email protected]

  • Size

    889KB

  • MD5

    98d9d150c0b4afc30efd34c22e176f56

  • SHA1

    ba286afad44a3f4f514aff7f1dca1c159f8cbec0

  • SHA256

    c9c89543724cc2517b6f7a873f9c33cc055c237829c65a268dbdf64a21b4dd95

  • SHA512

    8f03ca7edaebc084f20609f8005b85d8a0fc5d18187f67179b6799dd9c5c337a9584714bbafe9eedf6dbc405787b38b3fdbef723590fd16a4da7ab9b0571ca31

  • SSDEEP

    24576:WyBtjmCojfzv3J3LTT3onKLMplOBLG6+:J72fzv3ZbT0l

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ikechukwu123456789

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\Quotation#[email protected]
    "C:\Users\Admin\AppData\Local\Temp\Quotation#[email protected]"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2556
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OxswKUOe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp760A.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:3008
    • C:\Users\Admin\AppData\Local\Temp\Quotation#[email protected]
      "{path}"
      2⤵
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2880

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp760A.tmp

    Filesize

    1KB

    MD5

    a05029f1f39789c112cd3d8e539f08b5

    SHA1

    3fa82426a6021a048d6525b95b9b097dc764a9f2

    SHA256

    bf016c2db33b9797ad0df08dc2e5f16569fe2c8f87c3685551da885f5e018844

    SHA512

    e1908ec54dbcc0bf63a9c336864ae463c0a5c25bff142fc8d941d39264ed2c6bb6d2ae48a43014e578c0f796834f2d5bea9afe3c4318393539fb92d1e5be5dd0

  • memory/2556-21-0x0000000074120000-0x000000007480E000-memory.dmp

    Filesize

    6.9MB

  • memory/2556-1-0x0000000001290000-0x0000000001374000-memory.dmp

    Filesize

    912KB

  • memory/2556-2-0x0000000000470000-0x0000000000482000-memory.dmp

    Filesize

    72KB

  • memory/2556-3-0x000000007412E000-0x000000007412F000-memory.dmp

    Filesize

    4KB

  • memory/2556-4-0x0000000074120000-0x000000007480E000-memory.dmp

    Filesize

    6.9MB

  • memory/2556-5-0x0000000005490000-0x0000000005532000-memory.dmp

    Filesize

    648KB

  • memory/2556-6-0x0000000005630000-0x00000000056C8000-memory.dmp

    Filesize

    608KB

  • memory/2556-0-0x000000007412E000-0x000000007412F000-memory.dmp

    Filesize

    4KB

  • memory/2880-22-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/2880-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2880-23-0x0000000074120000-0x000000007480E000-memory.dmp

    Filesize

    6.9MB

  • memory/2880-16-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/2880-13-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/2880-18-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/2880-12-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/2880-10-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/2880-11-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/2880-24-0x0000000074120000-0x000000007480E000-memory.dmp

    Filesize

    6.9MB

  • memory/2880-25-0x0000000074120000-0x000000007480E000-memory.dmp

    Filesize

    6.9MB