Analysis
- max time kernel
979s - max time network
981s - platform
windows7_x64 - resource
win7v20210408 - submitted
20/09/2021, 18:44
General
- Target ADDRESS_.EXE
- Size 887KB
- Sample210920-xdtvesfac5
- SHA256 c8a169a01d9e9282b339a9a73e395ec11d201878773ff45b15e55de3e4be7c5e
Malware Config
Extracted
-
agenttesla
-
https://api.telegram.org/bot1999677510:AAHhNzHnb72ldnvRVF1mzkCYnWBTejckz6s/sendDocument
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 3 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ADDRESS_.EXE"C:\Users\Admin\AppData\Local\Temp\ADDRESS_.EXE"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ADDRESS_.EXE"C:\Users\Admin\AppData\Local\Temp\ADDRESS_.EXE"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1096-60-0x0000000000BB0000-0x0000000000BB1000-memory.dmp
memory/1096-62-0x0000000000760000-0x000000000077D000-memory.dmp
memory/1096-63-0x00000000009F0000-0x00000000009F1000-memory.dmp
memory/1096-64-0x00000000056A0000-0x0000000005714000-memory.dmp
memory/1096-65-0x0000000004F60000-0x0000000004FA3000-memory.dmp
memory/1208-66-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1208-68-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1208-70-0x0000000004850000-0x0000000004851000-memory.dmp
memory/1208-71-0x0000000004851000-0x0000000004852000-memory.dmp