Analysis
-
max time kernel
66s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 01:18
Behavioral task
behavioral1
Sample
b64fd7e8967cda865697ba24afaf86ea774f813ddea418980fca84e808451902.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b64fd7e8967cda865697ba24afaf86ea774f813ddea418980fca84e808451902.exe
Resource
win10v2004-20240419-en
General
-
Target
b64fd7e8967cda865697ba24afaf86ea774f813ddea418980fca84e808451902.exe
-
Size
244KB
-
MD5
2305755f146381f9450127182148c48b
-
SHA1
a25f4a4e819d936ddaa43231750e2e8149e8a9ef
-
SHA256
b64fd7e8967cda865697ba24afaf86ea774f813ddea418980fca84e808451902
-
SHA512
52ab92b2f7fa093af325e704c94acdfcab257e54e49e5686e14712ce5b68cdca51a65205321c99c82988e36cf0e6b24f1b92d9979dfd71e184c12c0da0476495
-
SSDEEP
1536:+Y4obH+RCepMwM4Mnk04v1SP2uqLNzj71prKzU64sYY8OdA274m5VYQWlUDkBO9k:b4QUMwM4M++3aP64h274m5SHUDkBO4H
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
erkin.permanov@seda-medical.com - Password:
ablegod1122 - Email To:
erkin.permanov@seda-medical.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.ipify.org -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
b64fd7e8967cda865697ba24afaf86ea774f813ddea418980fca84e808451902.exepid process 2224 b64fd7e8967cda865697ba24afaf86ea774f813ddea418980fca84e808451902.exe 2224 b64fd7e8967cda865697ba24afaf86ea774f813ddea418980fca84e808451902.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b64fd7e8967cda865697ba24afaf86ea774f813ddea418980fca84e808451902.exedescription pid process Token: SeDebugPrivilege 2224 b64fd7e8967cda865697ba24afaf86ea774f813ddea418980fca84e808451902.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
b64fd7e8967cda865697ba24afaf86ea774f813ddea418980fca84e808451902.exepid process 2224 b64fd7e8967cda865697ba24afaf86ea774f813ddea418980fca84e808451902.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b64fd7e8967cda865697ba24afaf86ea774f813ddea418980fca84e808451902.exe"C:\Users\Admin\AppData\Local\Temp\b64fd7e8967cda865697ba24afaf86ea774f813ddea418980fca84e808451902.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2224-0-0x0000000000100000-0x0000000000144000-memory.dmpFilesize
272KB
-
memory/2224-1-0x0000000074A60000-0x0000000075210000-memory.dmpFilesize
7.7MB
-
memory/2224-2-0x0000000004F30000-0x00000000054D4000-memory.dmpFilesize
5.6MB
-
memory/2224-3-0x0000000004920000-0x0000000004930000-memory.dmpFilesize
64KB
-
memory/2224-4-0x0000000004AF0000-0x0000000004B56000-memory.dmpFilesize
408KB
-
memory/2224-5-0x0000000006340000-0x0000000006390000-memory.dmpFilesize
320KB
-
memory/2224-6-0x0000000006430000-0x00000000064CC000-memory.dmpFilesize
624KB
-
memory/2224-7-0x0000000074A60000-0x0000000075210000-memory.dmpFilesize
7.7MB
-
memory/2224-8-0x0000000004920000-0x0000000004930000-memory.dmpFilesize
64KB
-
memory/2224-9-0x0000000006570000-0x0000000006602000-memory.dmpFilesize
584KB
-
memory/2224-10-0x00000000064F0000-0x00000000064FA000-memory.dmpFilesize
40KB