Analysis
-
max time kernel
35s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
11-11-2024 15:20
Static task
static1
Behavioral task
behavioral1
Sample
LPO24.0524.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
LPO24.0524.exe
Resource
win10v2004-20241007-en
General
-
Target
LPO24.0524.exe
-
Size
750KB
-
MD5
d00531e7583018b9f595cf27699ca567
-
SHA1
83c7ea4e944dd3a88bd1c3d6d8461e2f74b5e182
-
SHA256
c071e52c0f19cbedbad1c026a30b9a2d5f6268c8e9a742c802f322bff7fcf372
-
SHA512
7406c0f9c735b5c3b4cfe6fef7dd02b80c0d397e9c467abec23e51c68c5cff3557b8b08f52c1c934a88028cb1d1e3a2c83f2b215d594106beb1288d6b588c46e
-
SSDEEP
12288:G+LMv6T7nCm3ey512o0vQdZ4zUZ7BTJW6u45okpyvGBAwHRK3p:tLMvsCmuyPg+Kzi7BTJS4SKyvGBAD
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mbarieservicesltd.com - Port:
587 - Username:
[email protected] - Password:
*o9H+18Q4%;M - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
LPO24.0524.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LPO24.0524.exe Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LPO24.0524.exe Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LPO24.0524.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
LPO24.0524.exedescription pid Process procid_target PID 1736 set thread context of 2932 1736 LPO24.0524.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
powershell.exeLPO24.0524.exeLPO24.0524.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LPO24.0524.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LPO24.0524.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid Process 2960 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
LPO24.0524.exepowershell.exedescription pid Process Token: SeDebugPrivilege 2932 LPO24.0524.exe Token: SeDebugPrivilege 2960 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
LPO24.0524.exedescription pid Process procid_target PID 1736 wrote to memory of 2960 1736 LPO24.0524.exe 30 PID 1736 wrote to memory of 2960 1736 LPO24.0524.exe 30 PID 1736 wrote to memory of 2960 1736 LPO24.0524.exe 30 PID 1736 wrote to memory of 2960 1736 LPO24.0524.exe 30 PID 1736 wrote to memory of 2932 1736 LPO24.0524.exe 32 PID 1736 wrote to memory of 2932 1736 LPO24.0524.exe 32 PID 1736 wrote to memory of 2932 1736 LPO24.0524.exe 32 PID 1736 wrote to memory of 2932 1736 LPO24.0524.exe 32 PID 1736 wrote to memory of 2932 1736 LPO24.0524.exe 32 PID 1736 wrote to memory of 2932 1736 LPO24.0524.exe 32 PID 1736 wrote to memory of 2932 1736 LPO24.0524.exe 32 PID 1736 wrote to memory of 2932 1736 LPO24.0524.exe 32 PID 1736 wrote to memory of 2932 1736 LPO24.0524.exe 32 -
outlook_office_path 1 IoCs
Processes:
LPO24.0524.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LPO24.0524.exe -
outlook_win_path 1 IoCs
Processes:
LPO24.0524.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 LPO24.0524.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LPO24.0524.exe"C:\Users\Admin\AppData\Local\Temp\LPO24.0524.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\LPO24.0524.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Users\Admin\AppData\Local\Temp\LPO24.0524.exe"C:\Users\Admin\AppData\Local\Temp\LPO24.0524.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2932
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1