Analysis
-
max time kernel
263s -
max time network
295s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-09-2021 00:36
General
-
Target
Elite Quote 20212510 PO Xlxs.exe
-
Size
1.4MB
-
MD5
0c90b42b697dbdb5962ba603edfc24e8
-
SHA1
18deef81deab0dc3580416bdc67590f0405f0da5
-
SHA256
24b60008050f342ffb0e3456dd968c6cf51d1d6b7ebaa55a913121eba78dc29b
-
SHA512
ac69ff2a2508f0748520aba70c0143d62064659d847e09df31fd274fd208f0d748595af1a021c33ea29868a20b70313826ab4c2b583b6455781bf7e4cb05150f
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.mmdqatar.com/ - Port:
21 - Username:
[email protected] - Password:
Mm.101010
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Elite Quote 20212510 PO Xlxs.exe"C:\Users\Admin\AppData\Local\Temp\Elite Quote 20212510 PO Xlxs.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Elite Quote 20212510 PO Xlxs.exe"{path}"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Elite Quote 20212510 PO Xlxs.exe.logMD5
5ce36f0c4d9568839c224ffaa10d5441
SHA169c0cdded0b415091641c3fbf64b7fbd7e285e47
SHA256c93c5a9fdaa44aeb7f25c89abed40a1ca6432bf3ea840e2820388bef68cd116a
SHA512a6ef350d4f36f35b42ce0b8a4df83f17fb0a4f66dcfa32617b22e642168291bede3b612969e0eec293d7ca1ba0aef7a05c31823bd41821e0880b609f280b0b83
-
memory/504-123-0x0000000008510000-0x0000000008585000-memory.dmpFilesize
468KB
-
memory/504-124-0x0000000008590000-0x00000000085C8000-memory.dmpFilesize
224KB
-
memory/504-118-0x0000000004E70000-0x0000000004E71000-memory.dmpFilesize
4KB
-
memory/504-119-0x0000000004DD0000-0x00000000052CE000-memory.dmpFilesize
5.0MB
-
memory/504-120-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/504-121-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB
-
memory/504-117-0x00000000052D0000-0x00000000052D1000-memory.dmpFilesize
4KB
-
memory/504-114-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/504-122-0x0000000002600000-0x000000000260E000-memory.dmpFilesize
56KB
-
memory/504-125-0x0000000008640000-0x0000000008641000-memory.dmpFilesize
4KB
-
memory/504-116-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/3160-127-0x00000000004375BE-mapping.dmp
-
memory/3160-126-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3160-133-0x0000000004FA0000-0x000000000549E000-memory.dmpFilesize
5.0MB
-
memory/3160-134-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB