Analysis

  • max time kernel
    137s
  • max time network
    113s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    27-07-2021 15:46

General

  • Target

    5fb3fc06922cf2e8d88beb2566b8a1bb.exe

  • Size

    810KB

  • MD5

    5fb3fc06922cf2e8d88beb2566b8a1bb

  • SHA1

    8dfefde2ed3ccc6a27f3d5e3ad873126e54b0103

  • SHA256

    bb8f297b69b83f67d611e5d0fd966efc9116a79598044c02e9a691a30fb7c07d

  • SHA512

    1881a375c1e84157bfc53cead2f7ee59ac3b6598808394ff464e115c27984a05432793028ecfb80dc983376835e187118c7d04de9fb9ee7882d6e65bbfbb9ae1

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.ccsp-india.com
  • Port:
    587
  • Username:
    vehicle@ccsp-india.com
  • Password:
    Lkp$CcsP1008

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload 4 IoCs
  • CustAttr .NET packer 1 IoCs

    Detects CustAttr .NET packer in memory.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5fb3fc06922cf2e8d88beb2566b8a1bb.exe
    "C:\Users\Admin\AppData\Local\Temp\5fb3fc06922cf2e8d88beb2566b8a1bb.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4056
    • C:\Users\Admin\AppData\Local\Temp\5fb3fc06922cf2e8d88beb2566b8a1bb.exe
      "C:\Users\Admin\AppData\Local\Temp\5fb3fc06922cf2e8d88beb2566b8a1bb.exe"
      2⤵
        PID:2660
      • C:\Users\Admin\AppData\Local\Temp\5fb3fc06922cf2e8d88beb2566b8a1bb.exe
        "C:\Users\Admin\AppData\Local\Temp\5fb3fc06922cf2e8d88beb2566b8a1bb.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1576

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Credential Access

    Credentials in Files

    3
    T1081

    Collection

    Data from Local System

    3
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1576-124-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/1576-135-0x0000000004D20000-0x000000000521E000-memory.dmp
      Filesize

      5.0MB

    • memory/1576-132-0x0000000005A80000-0x0000000005A81000-memory.dmp
      Filesize

      4KB

    • memory/1576-131-0x00000000051F0000-0x00000000051F1000-memory.dmp
      Filesize

      4KB

    • memory/1576-130-0x0000000004D20000-0x000000000521E000-memory.dmp
      Filesize

      5.0MB

    • memory/1576-125-0x000000000043769E-mapping.dmp
    • memory/4056-118-0x0000000004C00000-0x0000000004C01000-memory.dmp
      Filesize

      4KB

    • memory/4056-122-0x0000000008300000-0x0000000008382000-memory.dmp
      Filesize

      520KB

    • memory/4056-123-0x00000000083D0000-0x000000000840D000-memory.dmp
      Filesize

      244KB

    • memory/4056-121-0x0000000000A50000-0x0000000000A5B000-memory.dmp
      Filesize

      44KB

    • memory/4056-120-0x0000000004B60000-0x000000000505E000-memory.dmp
      Filesize

      5.0MB

    • memory/4056-119-0x0000000004A50000-0x0000000004A51000-memory.dmp
      Filesize

      4KB

    • memory/4056-114-0x0000000000160000-0x0000000000161000-memory.dmp
      Filesize

      4KB

    • memory/4056-117-0x0000000004A70000-0x0000000004A71000-memory.dmp
      Filesize

      4KB

    • memory/4056-116-0x0000000005060000-0x0000000005061000-memory.dmp
      Filesize

      4KB