Analysis
-
max time kernel
117s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
25-08-2023 14:53
General
-
Target
PRE-ALERT-HTHC22031529.exe
-
Size
98KB
-
MD5
7dbeb9ccb04ea7f800cc115f3ea2a231
-
SHA1
57e74904a72fa69c7c81a3c5aeb77865b32bfa11
-
SHA256
311f3f352aab9853825dd455bcf8721f7d25d48c27fb1b4bd1ae9103e31bd7f4
-
SHA512
55fb26f94f151ec825b4b29b7a62d938ecf709b75f4d559a0d6e37084f61a47735745f5a5932729f5d8faee5c929b2b8ff53c639a69ca496eec58e9fa5d3f8d9
-
SSDEEP
3072:rCcNPrLtoBQtwTzZSxH7SlQjbJWutGRKGV7+52wuI+ghGt5KrfcT5:rCcNPrLto+twT1SxH7SlQjbJWutGRKGt
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail92100.maychuemail.com - Port:
587 - Username:
[email protected] - Password:
Qwerty2020Hp## - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PRE-ALERT-HTHC22031529.exe"C:\Users\Admin\AppData\Local\Temp\PRE-ALERT-HTHC22031529.exe"1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
344B
MD5ad7b11a301e3de6e92523c72056403c4
SHA1feb781163f8c26f37465988294fadf135f85c9fa
SHA256263822fbab2c0404462e83d7a50e766a9580f199152fdc04a9c0edc2df5add0e
SHA512ec1a3fb1199f5ab0f35da820cf223b1f58ee3269257323e589788bd80a06faed468563a0f0095a6b5a97aa2aa498939a14a91cdc31bc6383c59f667304542668
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
120KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
976KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
4KB
-
Filesize
448KB
-
Filesize
304KB
-
Filesize
280KB
-
Filesize
256KB
-
Filesize
264KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB