Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
22-09-2024 20:53
Static task
static1
Behavioral task
behavioral1
Sample
052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe
Resource
win10v2004-20240910-en
General
-
Target
052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe
-
Size
1.1MB
-
MD5
ab65b7407318c476a31d5204caef97af
-
SHA1
a44440efa36f7c024f26e00ccee50671abc36ad9
-
SHA256
052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d
-
SHA512
cb452ba020a4eb620110909d6f62ff8747a61acee2e6dab6388b0d08f534e4464e647f63d93a11183ee6b95ff2af62002e1fc03279718385beac820039339d07
-
SSDEEP
24576:6NA3R5drXdtMxKuUStJxZ8uYWaR3g5a58/JB12mI08qpMY5aRcKXwZ3cMY:z5bluUYD84adg5SkJB12NqG2aMZ3tY
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
akunaesiobike
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation 052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe -
Executes dropped EXE 2 IoCs
pid Process 1944 arwup.pif 4220 RegSvcs.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon.exe = "c:\\20145506\\arwup.pif c:\\20145506\\WUGGDQ~1.NSQ" arwup.pif -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1944 set thread context of 4220 1944 arwup.pif 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arwup.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4220 RegSvcs.exe 4220 RegSvcs.exe 4220 RegSvcs.exe 4220 RegSvcs.exe 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 4220 RegSvcs.exe 4220 RegSvcs.exe 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif 1944 arwup.pif -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4220 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4220 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5068 wrote to memory of 1944 5068 052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe 87 PID 5068 wrote to memory of 1944 5068 052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe 87 PID 5068 wrote to memory of 1944 5068 052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe 87 PID 1944 wrote to memory of 4220 1944 arwup.pif 93 PID 1944 wrote to memory of 4220 1944 arwup.pif 93 PID 1944 wrote to memory of 4220 1944 arwup.pif 93 PID 1944 wrote to memory of 4220 1944 arwup.pif 93 PID 1944 wrote to memory of 4220 1944 arwup.pif 93 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe"C:\Users\Admin\AppData\Local\Temp\052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\20145506\arwup.pif"C:\20145506\arwup.pif" wuggdqksgh.nsq2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:4220
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
647KB
MD59fc46b6036032a8d8a89e3567a3dcec3
SHA142dcd68b4a35686b000a18efb4c2b2ae07d5cc94
SHA2560e96860caa7e17fdcacac170b59189eb500761d5a80954d92e7f7b0ecb6b9534
SHA51245c10d083b1abc6cfcb54cd5d1a5343c1f8b25ac89c3800b173634073204a94cc7bbbe52caa2c465af739a438cc0df7daf2a62defc5220b2b72e507dbae0be3d
-
Filesize
612KB
MD58aa0d9f17feec64c65db7752f5f534fa
SHA1f356053963c151f3c6f2c24c779d33c18bb391b6
SHA256649db74fc934a088796e828e252f69b489ec9df3ce4bf41469913f46706e5a59
SHA512676465cef32727fcda0cde07bdf1448a256d9bc3782ad06fd49feab2fdf18e9a9b1be4e0a70ce27af74366fac38c2de79b5342231fb1d960a02449e205d2593c
-
Filesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b