Analysis

  • max time kernel
    135s
  • max time network
    120s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    22-01-2021 14:35

General

  • Target

    L9oOm9x3I7YZFcA.exe

  • Size

    1.1MB

  • MD5

    4ae13376f629270025f6113b6fef91db

  • SHA1

    d7efd57f3ff3dd58bfff40d18c8dd70d58b2a1fa

  • SHA256

    b7f4f41e2140b9416ccfd8d0c89523bf774b9577302b107f8b143c5bdd3f6534

  • SHA512

    3c18523e21574ab3e63f4ef4874ed5aaab01cfcb38b1cf0c40941ccdf1c5c436765bf3b6776a1215841472ecbe034fdce9b2025dc0cac8727e26d9fc9eaaddf8

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.cefortem.cat
  • Port:
    587
  • Username:
    presidencia@cefortem.cat
  • Password:
    Vft284Rpyn

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\L9oOm9x3I7YZFcA.exe
    "C:\Users\Admin\AppData\Local\Temp\L9oOm9x3I7YZFcA.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4696
    • C:\Users\Admin\AppData\Local\Temp\L9oOm9x3I7YZFcA.exe
      "{path}"
      2⤵
        PID:504
      • C:\Users\Admin\AppData\Local\Temp\L9oOm9x3I7YZFcA.exe
        "{path}"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:496

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Credential Access

    Credentials in Files

    3
    T1081

    Collection

    Data from Local System

    3
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\L9oOm9x3I7YZFcA.exe.log
      MD5

      b4f7a6a57cb46d94b72410eb6a6d45a9

      SHA1

      69f3596ffa027202d391444b769ceea0ae14c5f7

      SHA256

      23994ebe221a48ea16ebad51ae0d4b47ccd415ae10581f9405e588d4f6c2523b

      SHA512

      be6da516e54c3a5b33ac2603137a2f8cf8445ff5961dd266faedf3627bae8979953d7ef305538df0151c609917a5b99bf5d023bdd32de50fd5c723950f90db5c

    • memory/496-13-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/496-23-0x0000000006120000-0x0000000006121000-memory.dmp
      Filesize

      4KB

    • memory/496-22-0x0000000005640000-0x0000000005641000-memory.dmp
      Filesize

      4KB

    • memory/496-21-0x0000000005660000-0x0000000005661000-memory.dmp
      Filesize

      4KB

    • memory/496-16-0x0000000073430000-0x0000000073B1E000-memory.dmp
      Filesize

      6.9MB

    • memory/496-14-0x00000000004374DE-mapping.dmp
    • memory/4696-7-0x0000000005170000-0x0000000005171000-memory.dmp
      Filesize

      4KB

    • memory/4696-11-0x0000000005280000-0x0000000005313000-memory.dmp
      Filesize

      588KB

    • memory/4696-12-0x00000000053D0000-0x00000000053D1000-memory.dmp
      Filesize

      4KB

    • memory/4696-10-0x000000000AB90000-0x000000000AB9E000-memory.dmp
      Filesize

      56KB

    • memory/4696-9-0x0000000005060000-0x0000000005061000-memory.dmp
      Filesize

      4KB

    • memory/4696-8-0x00000000050A0000-0x00000000050A1000-memory.dmp
      Filesize

      4KB

    • memory/4696-2-0x0000000073430000-0x0000000073B1E000-memory.dmp
      Filesize

      6.9MB

    • memory/4696-6-0x000000000AEF0000-0x000000000AEF1000-memory.dmp
      Filesize

      4KB

    • memory/4696-5-0x0000000007600000-0x00000000076EE000-memory.dmp
      Filesize

      952KB

    • memory/4696-3-0x00000000006F0000-0x00000000006F1000-memory.dmp
      Filesize

      4KB