Analysis

  • max time kernel
    118s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 20:06

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.16450.7009.exe

  • Size

    532KB

  • MD5

    b5eda468bb93c37515813b0da60c224b

  • SHA1

    b04276fc7f881147a4c18deb25f8538144819517

  • SHA256

    15a4c64ec2cdc0f9b77763c7ad7b0181e5852ed5e74d1090e6112a9f05d34e8a

  • SHA512

    3e97e5849f78ac81484807421a006c6b828ee4c73520e62fdfa1ad2e84dc5c915c57c85b1df72c42f30dd01798cd6439f66015e8e38e0aadd83a2ef165e07e38

  • SSDEEP

    12288:o7253FqFdIQydVzUblkLpn+CC4STNn/fPS:jCMVzUblkLpng/fP

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.16450.7009.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.16450.7009.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • outlook_office_path
    • outlook_win_path
    PID:3020

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3020-0-0x0000000000C50000-0x0000000000CDA000-memory.dmp

          Filesize

          552KB

        • memory/3020-1-0x0000000073EE0000-0x00000000745CE000-memory.dmp

          Filesize

          6.9MB

        • memory/3020-2-0x0000000004D20000-0x0000000004D60000-memory.dmp

          Filesize

          256KB

        • memory/3020-3-0x00000000002C0000-0x00000000002D0000-memory.dmp

          Filesize

          64KB

        • memory/3020-4-0x0000000073EE0000-0x00000000745CE000-memory.dmp

          Filesize

          6.9MB

        • memory/3020-5-0x0000000004D20000-0x0000000004D60000-memory.dmp

          Filesize

          256KB

        • memory/3020-6-0x00000000002F0000-0x00000000002FC000-memory.dmp

          Filesize

          48KB

        • memory/3020-7-0x0000000005460000-0x00000000054CA000-memory.dmp

          Filesize

          424KB

        • memory/3020-8-0x00000000005D0000-0x0000000000600000-memory.dmp

          Filesize

          192KB