Analysis
-
max time kernel
141s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
06-12-2022 13:35
General
-
Target
SecuriteInfo.com.Trojan.Siggen19.18804.30017.30212.exe
-
Size
885KB
-
MD5
cfd49eaec7f6ae012aad21687a52a311
-
SHA1
8ca719076e105c04f9f2c0a9a1e6d08c08dd3840
-
SHA256
4d7089ed0ea37bffbf210a1178cceab8b97ea2775d2d7efd478272c50374fde7
-
SHA512
c5756acc9fe06ea224c2385d2c4b37c1244919935a173b532d3ee2aba23c071d3c58708b8fd0cda518cb160e0bcfc29c5018ca55a3cf680fbfc4bcec22e2869f
-
SSDEEP
12288:BwlXfmomPZefnRftvbw6snXQNEwO0QDNag0G6VPkEz88GBkt6IiaxRoPa3Ptqvyd:RomxinR9bw3b04Nr0DV8ksK6u3QF/N
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.symmdentaesthetics.com/ - Port:
21 - Username:
[email protected]/ - Password:
smartooo@12
Protocol: ftp- Host:
ftp://ftp.symmdentaesthetics.com/ - Port:
21 - Username:
[email protected]/ - Password:
smartooo@12
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen19.18804.30017.30212.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen19.18804.30017.30212.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NcJlKP.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NcJlKP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1E51.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen19.18804.30017.30212.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen19.18804.30017.30212.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1E51.tmpFilesize
1KB
MD5765b1f4c03364d3f2cf46f503f06e1cb
SHA15e3933827f72f5c3bbda0a72da403e65e899dfe3
SHA2560610558c7f2cb1a73da28f8edac0d9b68f82abc6f4344c40a3af43ccb314e585
SHA5120584427c473f8e068a218c7e1c48b9d0ae7ebb752f93da201df4409754c2a971ce6aff050f7b20c668c884d2eb947fd97b5ea82e8c8fbcd329f2c2d00d2c0182
-
memory/884-133-0x0000000005650000-0x0000000005BF4000-memory.dmpFilesize
5.6MB
-
memory/884-134-0x00000000051A0000-0x0000000005232000-memory.dmpFilesize
584KB
-
memory/884-135-0x0000000005250000-0x000000000525A000-memory.dmpFilesize
40KB
-
memory/884-136-0x000000000AE00000-0x000000000AE9C000-memory.dmpFilesize
624KB
-
memory/884-132-0x0000000000720000-0x0000000000804000-memory.dmpFilesize
912KB
-
memory/2444-150-0x00000000063A0000-0x00000000063BE000-memory.dmpFilesize
120KB
-
memory/2444-151-0x0000000007750000-0x0000000007DCA000-memory.dmpFilesize
6.5MB
-
memory/2444-157-0x0000000007430000-0x0000000007438000-memory.dmpFilesize
32KB
-
memory/2444-141-0x0000000005070000-0x0000000005698000-memory.dmpFilesize
6.2MB
-
memory/2444-156-0x0000000007450000-0x000000000746A000-memory.dmpFilesize
104KB
-
memory/2444-155-0x0000000007340000-0x000000000734E000-memory.dmpFilesize
56KB
-
memory/2444-144-0x0000000004EC0000-0x0000000004EE2000-memory.dmpFilesize
136KB
-
memory/2444-145-0x0000000005710000-0x0000000005776000-memory.dmpFilesize
408KB
-
memory/2444-146-0x00000000057F0000-0x0000000005856000-memory.dmpFilesize
408KB
-
memory/2444-147-0x0000000005E00000-0x0000000005E1E000-memory.dmpFilesize
120KB
-
memory/2444-148-0x00000000063C0000-0x00000000063F2000-memory.dmpFilesize
200KB
-
memory/2444-149-0x0000000070CD0000-0x0000000070D1C000-memory.dmpFilesize
304KB
-
memory/2444-137-0x0000000000000000-mapping.dmp
-
memory/2444-139-0x00000000024E0000-0x0000000002516000-memory.dmpFilesize
216KB
-
memory/2444-152-0x0000000007100000-0x000000000711A000-memory.dmpFilesize
104KB
-
memory/2444-153-0x0000000007180000-0x000000000718A000-memory.dmpFilesize
40KB
-
memory/2444-154-0x0000000007390000-0x0000000007426000-memory.dmpFilesize
600KB
-
memory/3104-143-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3104-142-0x0000000000000000-mapping.dmp
-
memory/3748-138-0x0000000000000000-mapping.dmp