Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-09-2024 20:53
Static task
static1
Behavioral task
behavioral1
Sample
052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe
Resource
win10v2004-20240910-en
General
-
Target
052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe
-
Size
1.1MB
-
MD5
ab65b7407318c476a31d5204caef97af
-
SHA1
a44440efa36f7c024f26e00ccee50671abc36ad9
-
SHA256
052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d
-
SHA512
cb452ba020a4eb620110909d6f62ff8747a61acee2e6dab6388b0d08f534e4464e647f63d93a11183ee6b95ff2af62002e1fc03279718385beac820039339d07
-
SSDEEP
24576:6NA3R5drXdtMxKuUStJxZ8uYWaR3g5a58/JB12mI08qpMY5aRcKXwZ3cMY:z5bluUYD84adg5SkJB12NqG2aMZ3tY
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
akunaesiobike
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Executes dropped EXE 2 IoCs
pid Process 2776 arwup.pif 1360 RegSvcs.exe -
Loads dropped DLL 5 IoCs
pid Process 2280 052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe 2280 052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe 2280 052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe 2280 052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe 2776 arwup.pif -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon.exe = "c:\\20145506\\arwup.pif c:\\20145506\\WUGGDQ~1.NSQ" arwup.pif -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2776 set thread context of 1360 2776 arwup.pif 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arwup.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1360 RegSvcs.exe 1360 RegSvcs.exe 1360 RegSvcs.exe 1360 RegSvcs.exe 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 1360 RegSvcs.exe 1360 RegSvcs.exe 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif 2776 arwup.pif -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1360 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1360 RegSvcs.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2776 2280 052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe 30 PID 2280 wrote to memory of 2776 2280 052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe 30 PID 2280 wrote to memory of 2776 2280 052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe 30 PID 2280 wrote to memory of 2776 2280 052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe 30 PID 2776 wrote to memory of 1360 2776 arwup.pif 31 PID 2776 wrote to memory of 1360 2776 arwup.pif 31 PID 2776 wrote to memory of 1360 2776 arwup.pif 31 PID 2776 wrote to memory of 1360 2776 arwup.pif 31 PID 2776 wrote to memory of 1360 2776 arwup.pif 31 PID 2776 wrote to memory of 1360 2776 arwup.pif 31 PID 2776 wrote to memory of 1360 2776 arwup.pif 31 PID 2776 wrote to memory of 1360 2776 arwup.pif 31 PID 2776 wrote to memory of 1360 2776 arwup.pif 31 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe"C:\Users\Admin\AppData\Local\Temp\052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\20145506\arwup.pif"C:\20145506\arwup.pif" wuggdqksgh.nsq2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1360
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
612KB
MD58aa0d9f17feec64c65db7752f5f534fa
SHA1f356053963c151f3c6f2c24c779d33c18bb391b6
SHA256649db74fc934a088796e828e252f69b489ec9df3ce4bf41469913f46706e5a59
SHA512676465cef32727fcda0cde07bdf1448a256d9bc3782ad06fd49feab2fdf18e9a9b1be4e0a70ce27af74366fac38c2de79b5342231fb1d960a02449e205d2593c
-
Filesize
647KB
MD59fc46b6036032a8d8a89e3567a3dcec3
SHA142dcd68b4a35686b000a18efb4c2b2ae07d5cc94
SHA2560e96860caa7e17fdcacac170b59189eb500761d5a80954d92e7f7b0ecb6b9534
SHA51245c10d083b1abc6cfcb54cd5d1a5343c1f8b25ac89c3800b173634073204a94cc7bbbe52caa2c465af739a438cc0df7daf2a62defc5220b2b72e507dbae0be3d
-
Filesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215