Analysis
- max time kernel
149s - max time network
162s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
18/10/2023, 16:16
General
- Target QUOTE_FOR_Lindenberg-Emirates_UaW5mcTtv.exe
- Size 1.3MB
- Sample231018-tqslcahe46
- SHA256 cb6fa67a9123f512508752ef44aa9eb0861b57393ee37435574fb3d1b7e062dc
Malware Config
Extracted
-
agenttesla
-
https://api.telegram.org/bot6406258148:AAFg74MTSprDWByapev7PG7YtridOYOUFF0/
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTE_FOR_Lindenberg-Emirates_UaW5mcTtv.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE_FOR_Lindenberg-Emirates_UaW5mcTtv.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1036-2-0x00007FF6D7110000-0x00007FF6D7571000-memory.dmp
memory/1036-0-0x00007FF6D7110000-0x00007FF6D7571000-memory.dmp
memory/1224-6-0x00000000058C0000-0x0000000005926000-memory.dmp
memory/1224-3-0x0000000074590000-0x0000000074D40000-memory.dmp
memory/1224-4-0x0000000005EF0000-0x0000000006494000-memory.dmp
memory/1224-5-0x0000000005930000-0x0000000005940000-memory.dmp
memory/1224-1-0x0000000000400000-0x0000000000444000-memory.dmp
memory/1224-7-0x0000000074590000-0x0000000074D40000-memory.dmp
memory/1224-8-0x0000000005930000-0x0000000005940000-memory.dmp
memory/1224-9-0x0000000006F30000-0x0000000006F80000-memory.dmp
memory/1224-10-0x0000000007020000-0x00000000070BC000-memory.dmp
memory/1224-11-0x0000000007160000-0x00000000071F2000-memory.dmp
memory/1224-12-0x0000000007110000-0x000000000711A000-memory.dmp