Analysis
-
max time kernel
141s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17-09-2024 15:23
Static task
static1
Behavioral task
behavioral1
Sample
OrdemdeCompra.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
OrdemdeCompra.exe
Resource
win10v2004-20240802-en
General
-
Target
OrdemdeCompra.exe
-
Size
1.2MB
-
MD5
c7f2122c54ae2d9fa69c556d4b546f0b
-
SHA1
5f7e1874bb0a8829453a42384db00f23ea4d3e26
-
SHA256
33887e89b9bee91752a8ce8ba3090b7440f9be51454902a42c287fe87f87062a
-
SHA512
ab45d6c2791d7179a443e8e07230c3f2f7368d9b6a2fdfe2e82437ab37f230646ad2956667adf1213fcc7584cc16c33f3d593053a896893b06816581596bfa23
-
SSDEEP
24576:mRmJkcoQricOIQxiZY1iagXLH7HmDj2OtB5sxvRPTK+6qh4Qd/oY:jJZoQrbTFZY1iagbH7HOaOGBR7D42/oY
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.agaliofu.top - Port:
587 - Username:
[email protected] - Password:
QPS.6YYl.Yi= - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4092 set thread context of 4292 4092 OrdemdeCompra.exe 82 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OrdemdeCompra.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4292 RegSvcs.exe 4292 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4092 OrdemdeCompra.exe 4092 OrdemdeCompra.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4292 RegSvcs.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4092 wrote to memory of 4292 4092 OrdemdeCompra.exe 82 PID 4092 wrote to memory of 4292 4092 OrdemdeCompra.exe 82 PID 4092 wrote to memory of 4292 4092 OrdemdeCompra.exe 82 PID 4092 wrote to memory of 4292 4092 OrdemdeCompra.exe 82 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\OrdemdeCompra.exe"C:\Users\Admin\AppData\Local\Temp\OrdemdeCompra.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\OrdemdeCompra.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4292
-