Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-11-2024 14:25
Static task
static1
Behavioral task
behavioral1
Sample
LPO24.0524.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
LPO24.0524.exe
Resource
win10v2004-20241007-en
General
-
Target
LPO24.0524.exe
-
Size
750KB
-
MD5
d00531e7583018b9f595cf27699ca567
-
SHA1
83c7ea4e944dd3a88bd1c3d6d8461e2f74b5e182
-
SHA256
c071e52c0f19cbedbad1c026a30b9a2d5f6268c8e9a742c802f322bff7fcf372
-
SHA512
7406c0f9c735b5c3b4cfe6fef7dd02b80c0d397e9c467abec23e51c68c5cff3557b8b08f52c1c934a88028cb1d1e3a2c83f2b215d594106beb1288d6b588c46e
-
SSDEEP
12288:G+LMv6T7nCm3ey512o0vQdZ4zUZ7BTJW6u45okpyvGBAwHRK3p:tLMvsCmuyPg+Kzi7BTJS4SKyvGBAD
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mbarieservicesltd.com - Port:
587 - Username:
[email protected] - Password:
*o9H+18Q4%;M - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
LPO24.0524.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LPO24.0524.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LPO24.0524.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LPO24.0524.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
LPO24.0524.exedescription pid Process procid_target PID 2684 set thread context of 2396 2684 LPO24.0524.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
LPO24.0524.exeLPO24.0524.exepowershell.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LPO24.0524.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LPO24.0524.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid Process 2660 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
LPO24.0524.exepowershell.exedescription pid Process Token: SeDebugPrivilege 2396 LPO24.0524.exe Token: SeDebugPrivilege 2660 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
LPO24.0524.exedescription pid Process procid_target PID 2684 wrote to memory of 2660 2684 LPO24.0524.exe 31 PID 2684 wrote to memory of 2660 2684 LPO24.0524.exe 31 PID 2684 wrote to memory of 2660 2684 LPO24.0524.exe 31 PID 2684 wrote to memory of 2660 2684 LPO24.0524.exe 31 PID 2684 wrote to memory of 2396 2684 LPO24.0524.exe 33 PID 2684 wrote to memory of 2396 2684 LPO24.0524.exe 33 PID 2684 wrote to memory of 2396 2684 LPO24.0524.exe 33 PID 2684 wrote to memory of 2396 2684 LPO24.0524.exe 33 PID 2684 wrote to memory of 2396 2684 LPO24.0524.exe 33 PID 2684 wrote to memory of 2396 2684 LPO24.0524.exe 33 PID 2684 wrote to memory of 2396 2684 LPO24.0524.exe 33 PID 2684 wrote to memory of 2396 2684 LPO24.0524.exe 33 PID 2684 wrote to memory of 2396 2684 LPO24.0524.exe 33 -
outlook_office_path 1 IoCs
Processes:
LPO24.0524.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LPO24.0524.exe -
outlook_win_path 1 IoCs
Processes:
LPO24.0524.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LPO24.0524.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LPO24.0524.exe"C:\Users\Admin\AppData\Local\Temp\LPO24.0524.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\LPO24.0524.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
-
C:\Users\Admin\AppData\Local\Temp\LPO24.0524.exe"C:\Users\Admin\AppData\Local\Temp\LPO24.0524.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2396
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1