Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

27/12/2022, 14:34

221227-rxqn8afa54 10

27/12/2022, 14:34

221227-rxfh9afa52 10

25/12/2022, 11:46

221225-nxcwksee8w 10

Analysis

  • max time kernel
    91s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2022, 11:46

General

  • Target

    1c15539131a4b7a2864bf1cc5744ea213fce23e8b643d2cd00f0a242f4e775b2.exe

  • Size

    1.0MB

  • MD5

    1a5e881a5197cdee0fd2be1af368198a

  • SHA1

    3ff94ebf7ed66aadafa66b28f01f3a4beeadb98c

  • SHA256

    1c15539131a4b7a2864bf1cc5744ea213fce23e8b643d2cd00f0a242f4e775b2

  • SHA512

    8c75be3273a8d8b1043e3e4e2034cd00a8bb33c404ae2441619e16113b24723159a46a6fce4526ae31040e1bd3ee7368340ad7bbbb2fe4d0c9d15d78fdc4ffb2

  • SSDEEP

    12288:attzg2iNNvemxU2Uy49rF+mu3bk0RqV4Ef3JdselFDnw7Vu:QBg1vxUWcIrk0Rqf3Jd1FLIV

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5618720367:AAFqeS2K5cBYFRaIBpS6oi_RaSYSI0_A__w/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c15539131a4b7a2864bf1cc5744ea213fce23e8b643d2cd00f0a242f4e775b2.exe
    "C:\Users\Admin\AppData\Local\Temp\1c15539131a4b7a2864bf1cc5744ea213fce23e8b643d2cd00f0a242f4e775b2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Users\Admin\AppData\Local\Temp\1c15539131a4b7a2864bf1cc5744ea213fce23e8b643d2cd00f0a242f4e775b2.exe
      "C:\Users\Admin\AppData\Local\Temp\1c15539131a4b7a2864bf1cc5744ea213fce23e8b643d2cd00f0a242f4e775b2.exe"
      2⤵
        PID:3584
      • C:\Users\Admin\AppData\Local\Temp\1c15539131a4b7a2864bf1cc5744ea213fce23e8b643d2cd00f0a242f4e775b2.exe
        "C:\Users\Admin\AppData\Local\Temp\1c15539131a4b7a2864bf1cc5744ea213fce23e8b643d2cd00f0a242f4e775b2.exe"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • outlook_office_path
        • outlook_win_path
        PID:2800

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1c15539131a4b7a2864bf1cc5744ea213fce23e8b643d2cd00f0a242f4e775b2.exe.log

      Filesize

      1KB

      MD5

      e08f822522c617a40840c62e4b0fb45e

      SHA1

      ae516dca4da5234be6676d3f234c19ec55725be7

      SHA256

      bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7

      SHA512

      894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4

    • memory/2800-140-0x0000000000400000-0x000000000043A000-memory.dmp

      Filesize

      232KB

    • memory/2800-142-0x0000000006930000-0x0000000006980000-memory.dmp

      Filesize

      320KB

    • memory/4740-132-0x00000000004F0000-0x00000000005FC000-memory.dmp

      Filesize

      1.0MB

    • memory/4740-133-0x00000000055D0000-0x0000000005B74000-memory.dmp

      Filesize

      5.6MB

    • memory/4740-134-0x0000000005020000-0x00000000050B2000-memory.dmp

      Filesize

      584KB

    • memory/4740-135-0x0000000004F90000-0x0000000004F9A000-memory.dmp

      Filesize

      40KB

    • memory/4740-136-0x0000000009F40000-0x0000000009FDC000-memory.dmp

      Filesize

      624KB

    • memory/4740-137-0x000000000A050000-0x000000000A0B6000-memory.dmp

      Filesize

      408KB