Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2023, 02:01 UTC

General

  • Target

    231121-06-AgentTesla-b971a6.exe

  • Size

    570KB

  • MD5

    65edafe0dc5427f4cec4e29ad9cb18bc

  • SHA1

    b971a6aaf0c0daa035d9186b9cc49e72a5fc9976

  • SHA256

    e68f725f8d131c3cc5e5cbac5bc454cd9c1848039ee706c975262ef2073e75d3

  • SHA512

    a0c4bb45bd0dfa245a13502f0e51758ca2ec878a9eeec3ec0b82cdb2125981bf0de89f07c84029360676149bb61476345a032c9338bf9a3e304ea4e9e4e6b8fe

  • SSDEEP

    12288:bXHfGsaMlvWCwqLRtT34We8Op0UHUpIPEGWQAwna:bXHe8BLRtTn52EG5Awna

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.experthvac.ro
  • Port:
    21
  • Username:
    FTPAdmin@experthvac.ro
  • Password:
    -8{jszMOY*Z8(~Za0#jyP%o7VoB.0)kk^)7_

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\231121-06-AgentTesla-b971a6.exe
    "C:\Users\Admin\AppData\Local\Temp\231121-06-AgentTesla-b971a6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:1016

Network

  • flag-us
    DNS
    59.128.231.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    59.128.231.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    67.254.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    67.254.221.88.in-addr.arpa
    IN PTR
    Response
    67.254.221.88.in-addr.arpa
    IN PTR
    a88-221-254-67deploystaticakamaitechnologiescom
  • flag-us
    DNS
    64.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    64.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    208.194.73.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    208.194.73.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    193.78.101.95.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    193.78.101.95.in-addr.arpa
    IN PTR
    Response
    193.78.101.95.in-addr.arpa
    IN PTR
    a95-101-78-193deploystaticakamaitechnologiescom
  • flag-us
    DNS
    22.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    254.43.238.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    254.43.238.8.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    24.73.42.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    24.73.42.20.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    59.128.231.4.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    59.128.231.4.in-addr.arpa

  • 8.8.8.8:53
    67.254.221.88.in-addr.arpa
    dns
    72 B
    137 B
    1
    1

    DNS Request

    67.254.221.88.in-addr.arpa

  • 8.8.8.8:53
    64.159.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    64.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    208.194.73.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    208.194.73.20.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
    156 B
    1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    240.221.184.93.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    240.221.184.93.in-addr.arpa

  • 8.8.8.8:53
    193.78.101.95.in-addr.arpa
    dns
    72 B
    137 B
    1
    1

    DNS Request

    193.78.101.95.in-addr.arpa

  • 8.8.8.8:53
    22.236.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    22.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    254.43.238.8.in-addr.arpa
    dns
    71 B
    125 B
    1
    1

    DNS Request

    254.43.238.8.in-addr.arpa

  • 8.8.8.8:53
    24.73.42.20.in-addr.arpa
    dns
    70 B
    156 B
    1
    1

    DNS Request

    24.73.42.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1016-14-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/1016-23-0x0000000005110000-0x0000000005120000-memory.dmp

    Filesize

    64KB

  • memory/1016-22-0x0000000074690000-0x0000000074E40000-memory.dmp

    Filesize

    7.7MB

  • memory/1016-21-0x00000000065E0000-0x00000000067A2000-memory.dmp

    Filesize

    1.8MB

  • memory/1016-20-0x0000000006390000-0x00000000063E0000-memory.dmp

    Filesize

    320KB

  • memory/1016-19-0x0000000004FF0000-0x0000000005056000-memory.dmp

    Filesize

    408KB

  • memory/1016-18-0x0000000005110000-0x0000000005120000-memory.dmp

    Filesize

    64KB

  • memory/1016-17-0x0000000074690000-0x0000000074E40000-memory.dmp

    Filesize

    7.7MB

  • memory/4768-10-0x0000000004F90000-0x0000000004FA0000-memory.dmp

    Filesize

    64KB

  • memory/4768-16-0x0000000074690000-0x0000000074E40000-memory.dmp

    Filesize

    7.7MB

  • memory/4768-0-0x00000000003F0000-0x0000000000484000-memory.dmp

    Filesize

    592KB

  • memory/4768-11-0x0000000004F90000-0x0000000004FA0000-memory.dmp

    Filesize

    64KB

  • memory/4768-12-0x0000000006EC0000-0x0000000006EDA000-memory.dmp

    Filesize

    104KB

  • memory/4768-13-0x0000000007080000-0x0000000007086000-memory.dmp

    Filesize

    24KB

  • memory/4768-8-0x0000000004F90000-0x0000000004FA0000-memory.dmp

    Filesize

    64KB

  • memory/4768-9-0x0000000074690000-0x0000000074E40000-memory.dmp

    Filesize

    7.7MB

  • memory/4768-7-0x0000000005EE0000-0x0000000005EEA000-memory.dmp

    Filesize

    40KB

  • memory/4768-6-0x0000000005F00000-0x0000000005F92000-memory.dmp

    Filesize

    584KB

  • memory/4768-5-0x0000000005E00000-0x0000000005E44000-memory.dmp

    Filesize

    272KB

  • memory/4768-4-0x0000000004F90000-0x0000000004FA0000-memory.dmp

    Filesize

    64KB

  • memory/4768-3-0x0000000005650000-0x0000000005BF4000-memory.dmp

    Filesize

    5.6MB

  • memory/4768-2-0x0000000005000000-0x000000000509C000-memory.dmp

    Filesize

    624KB

  • memory/4768-1-0x0000000074690000-0x0000000074E40000-memory.dmp

    Filesize

    7.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.