Analysis
- max time kernel
143s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231020-en - resource tags
- submitted
02/11/2023, 04:18
General
- Target SecuriteInfo.com.Win32.TrojanX-gen.6911.387.exe
- Size 588KB
- Sample231102-ewybfshf63
- SHA256 066b80f163774df79a3f3da5fcea27fd1b2b8edc54da2be90aca5b53abe0c590
Malware Config
Extracted
-
Protocol
smtp
-
Host
smtp.nutiribio.com
-
Port
587
-
Username
-
Password
ATSzdD^8
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.nutiribio.com
-
Port
587
-
Username
-
Password
ATSzdD^8
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.6911.387.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.6911.387.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.6911.387.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.6911.387.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SecuriteInfo.com.Win32.TrojanX-gen.6911.387.exe.log
memory/4384-10-0x0000000006620000-0x000000000669A000-memory.dmp
memory/4384-2-0x0000000005600000-0x0000000005BA4000-memory.dmp
memory/4384-3-0x0000000004F70000-0x0000000005002000-memory.dmp
memory/4384-4-0x0000000005200000-0x0000000005210000-memory.dmp
memory/4384-5-0x0000000005020000-0x000000000502A000-memory.dmp
memory/4384-6-0x0000000005310000-0x000000000531E000-memory.dmp
memory/4384-7-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/4384-8-0x0000000005200000-0x0000000005210000-memory.dmp
memory/4384-0-0x0000000000680000-0x0000000000718000-memory.dmp
memory/4384-9-0x00000000055D0000-0x00000000055DA000-memory.dmp
memory/4384-1-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/4384-16-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/4384-11-0x0000000008C60000-0x0000000008CFC000-memory.dmp
memory/4836-12-0x0000000000400000-0x0000000000440000-memory.dmp
memory/4836-15-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/4836-17-0x0000000005670000-0x0000000005680000-memory.dmp
memory/4836-18-0x00000000057C0000-0x0000000005826000-memory.dmp
memory/4836-19-0x0000000006DF0000-0x0000000006E40000-memory.dmp
memory/4836-20-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/4836-21-0x0000000005670000-0x0000000005680000-memory.dmp