Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
06/11/2023, 01:36
General
-
Target
16dfa584469cb9749215b87fb90e69dd2e10e2cf7c8d0a18b075e330a3b21d09.exe
-
Size
240KB
-
MD5
450a4ab336664ce75f68c7834800fcb8
-
SHA1
981571f6e46d00bfadf9e88a1e780766c321a8ac
-
SHA256
16dfa584469cb9749215b87fb90e69dd2e10e2cf7c8d0a18b075e330a3b21d09
-
SHA512
17edf46c32c8df85380fbfec7b4c5b399875b28b10b960418dcac4147b66df8457dacb3e66d046f170a5bec85c8a39ada9b6d09c133868c3b8291c1dd87165fa
-
SSDEEP
3072:CdA67f9xtpdnNVtf9IXSHwRRODpzfEmYFDwu5LCK+9GR:Ca67f9xtpdnNVtf9ICHwRROoFDwNKCG
Malware Config
Extracted
Protocol: ftp- Host:
ftp.atelierzolotas.gr - Port:
21 - Username:
[email protected] - Password:
alibaba.com
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.atelierzolotas.gr - Port:
21 - Username:
[email protected] - Password:
alibaba.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\16dfa584469cb9749215b87fb90e69dd2e10e2cf7c8d0a18b075e330a3b21d09.exe"C:\Users\Admin\AppData\Local\Temp\16dfa584469cb9749215b87fb90e69dd2e10e2cf7c8d0a18b075e330a3b21d09.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB