Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2023 14:26
Static task
static1
Behavioral task
behavioral1
Sample
tmpx3vyntn0.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
tmpx3vyntn0.exe
Resource
win10v2004-20231127-en
General
-
Target
tmpx3vyntn0.exe
-
Size
266KB
-
MD5
992892eea003d621f694547d2284e39f
-
SHA1
7bf5627a0c7ec6d62578c9a95862c2ec4c3cabb6
-
SHA256
63f6d9e02b303e2062153d062ebc15c5ea7e05e36e5b92e48f60730c782fc9bb
-
SHA512
3e8237eb59fea1cd601cf5ca9d5b2fe7cb2cd7474e534f1315a0354f2d64300cb6b03944e80fe73fff60168dbe64cb82eec2ad0067b7a1346c4a0032dec5f8fa
-
SSDEEP
6144:mnSDik95vQ2vov1+QNRFH0Wm0jydwJxSHiiyV+9gffIxmk5:Dik95vNvov1+QLJ0Wm0LSJyqg3Ixm
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6609066655:AAFvSlYuljpA1ReJkQXiHiJh0XH1Axk0H-A/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tmpx3vyntn0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Roaming\\dllhost\\dllhost.exe" tmpx3vyntn0.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 30 ip-api.com -
Suspicious use of SetThreadContext 7 IoCs
Processes:
tmpx3vyntn0.exedescription pid process target process PID 1060 set thread context of 2284 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 set thread context of 4644 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 set thread context of 1868 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 set thread context of 1268 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 set thread context of 852 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 set thread context of 5108 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 set thread context of 4404 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4776 1268 WerFault.exe tmpx3vyntn0.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
tmpx3vyntn0.exepid process 2284 tmpx3vyntn0.exe 2284 tmpx3vyntn0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
tmpx3vyntn0.exedescription pid process Token: SeDebugPrivilege 2284 tmpx3vyntn0.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
tmpx3vyntn0.exepid process 2284 tmpx3vyntn0.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
tmpx3vyntn0.exedescription pid process target process PID 1060 wrote to memory of 2284 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 2284 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 2284 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 2284 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 2284 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 2284 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 2284 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 2284 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 4644 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 4644 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 4644 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 4644 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 1868 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 1868 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 1868 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 1868 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 1268 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 1268 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 1268 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 1268 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 852 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 852 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 852 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 852 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 852 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 852 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 852 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 852 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 5108 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 5108 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 5108 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 5108 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 5108 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 5108 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 5108 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 5108 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 4404 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 4404 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 4404 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 4404 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 4404 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 4404 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 4404 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 4404 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 2468 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 2468 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 2468 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 2468 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 1060 wrote to memory of 2468 1060 tmpx3vyntn0.exe tmpx3vyntn0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"2⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"2⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"2⤵PID:1268
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 803⤵
- Program crash
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"2⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"2⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"2⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"2⤵PID:2468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4644 -ip 46441⤵PID:1264
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1868 -ip 18681⤵PID:1908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1268 -ip 12681⤵PID:4160