Analysis

  • max time kernel
    144s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    27-07-2021 16:26

General

  • Target

    c277827a2afe5d23f11448d75291342c.exe

  • Size

    513KB

  • MD5

    c277827a2afe5d23f11448d75291342c

  • SHA1

    84528fcebd7c5dd3b118dad30bbb3ee30566f98e

  • SHA256

    be98f101070d1ef350f5d1768e640f5f23b047f890fde74495e49b9f6fa4d00b

  • SHA512

    eadd268f6e0932fcb70be92a55d7af04811943c655ea9abb464f6358fe36f7f34b38d2ee29ec2a36c890987cdbc1f1b694d358f488b1d274d64f3924d957e156

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1805574870:AAHXBVpTNJET3oRosoa2brFL9_G19NkXu8I/sendDocument

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c277827a2afe5d23f11448d75291342c.exe
    "C:\Users\Admin\AppData\Local\Temp\c277827a2afe5d23f11448d75291342c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Users\Admin\AppData\Local\Temp\c277827a2afe5d23f11448d75291342c.exe
      C:\Users\Admin\AppData\Local\Temp\c277827a2afe5d23f11448d75291342c.exe
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3984

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Collection

Data from Local System

3
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\c277827a2afe5d23f11448d75291342c.exe.log
    MD5

    9e7845217df4a635ec4341c3d52ed685

    SHA1

    d65cb39d37392975b038ce503a585adadb805da5

    SHA256

    d60e596ed3d5c13dc9f1660e6d870d99487e1383891437645c4562a9ecaa8c9b

    SHA512

    307c3b4d4f2655bdeb177e7b9c981ca27513618903f02c120caa755c9da5a8dd03ebab660b56108a680720a97c1e9596692490aede18cc4bd77b9fc3d8e68aa1

  • memory/3984-128-0x0000000000400000-0x000000000043C000-memory.dmp
    Filesize

    240KB

  • memory/3984-137-0x0000000006330000-0x0000000006331000-memory.dmp
    Filesize

    4KB

  • memory/3984-136-0x0000000005A70000-0x0000000005A71000-memory.dmp
    Filesize

    4KB

  • memory/3984-135-0x00000000055D0000-0x0000000005ACE000-memory.dmp
    Filesize

    5.0MB

  • memory/3984-134-0x00000000057A0000-0x00000000057A1000-memory.dmp
    Filesize

    4KB

  • memory/3984-129-0x000000000043773E-mapping.dmp
  • memory/4648-119-0x0000000004F50000-0x0000000004F51000-memory.dmp
    Filesize

    4KB

  • memory/4648-127-0x0000000008B60000-0x0000000008BD5000-memory.dmp
    Filesize

    468KB

  • memory/4648-122-0x00000000069D0000-0x0000000006A29000-memory.dmp
    Filesize

    356KB

  • memory/4648-120-0x0000000004ED0000-0x00000000053CE000-memory.dmp
    Filesize

    5.0MB

  • memory/4648-121-0x0000000004ED0000-0x00000000053CE000-memory.dmp
    Filesize

    5.0MB

  • memory/4648-114-0x0000000000690000-0x0000000000691000-memory.dmp
    Filesize

    4KB

  • memory/4648-118-0x0000000004ED0000-0x00000000053CE000-memory.dmp
    Filesize

    5.0MB

  • memory/4648-117-0x0000000004F70000-0x0000000004F71000-memory.dmp
    Filesize

    4KB

  • memory/4648-116-0x00000000053D0000-0x00000000053D1000-memory.dmp
    Filesize

    4KB