Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2023 16:56
Static task
static1
Behavioral task
behavioral1
Sample
tmpx3vyntn0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
tmpx3vyntn0.exe
Resource
win10v2004-20231130-en
General
-
Target
tmpx3vyntn0.exe
-
Size
266KB
-
MD5
992892eea003d621f694547d2284e39f
-
SHA1
7bf5627a0c7ec6d62578c9a95862c2ec4c3cabb6
-
SHA256
63f6d9e02b303e2062153d062ebc15c5ea7e05e36e5b92e48f60730c782fc9bb
-
SHA512
3e8237eb59fea1cd601cf5ca9d5b2fe7cb2cd7474e534f1315a0354f2d64300cb6b03944e80fe73fff60168dbe64cb82eec2ad0067b7a1346c4a0032dec5f8fa
-
SSDEEP
6144:mnSDik95vQ2vov1+QNRFH0Wm0jydwJxSHiiyV+9gffIxmk5:Dik95vNvov1+QLJ0Wm0LSJyqg3Ixm
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6609066655:AAFvSlYuljpA1ReJkQXiHiJh0XH1Axk0H-A/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tmpx3vyntn0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-596315103-1488671723-776734015-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Roaming\\dllhost\\dllhost.exe" tmpx3vyntn0.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Suspicious use of SetThreadContext 7 IoCs
Processes:
tmpx3vyntn0.exedescription pid process target process PID 2096 set thread context of 1608 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 set thread context of 4564 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 set thread context of 3340 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 set thread context of 1012 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 set thread context of 1616 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 set thread context of 4396 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 set thread context of 4724 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
tmpx3vyntn0.exetmpx3vyntn0.exepid process 1608 tmpx3vyntn0.exe 1608 tmpx3vyntn0.exe 1012 tmpx3vyntn0.exe 1012 tmpx3vyntn0.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmpx3vyntn0.exetmpx3vyntn0.exedescription pid process Token: SeDebugPrivilege 1608 tmpx3vyntn0.exe Token: SeDebugPrivilege 1012 tmpx3vyntn0.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
tmpx3vyntn0.exepid process 1608 tmpx3vyntn0.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
tmpx3vyntn0.exedescription pid process target process PID 2096 wrote to memory of 1608 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1608 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1608 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1608 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1608 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1608 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1608 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1608 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4564 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4564 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4564 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4564 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 3340 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 3340 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 3340 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 3340 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 3340 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 3340 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 3340 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 3340 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1012 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1012 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1012 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1012 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1012 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1012 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1012 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1012 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1616 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1616 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1616 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1616 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1616 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 1616 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4396 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4396 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4396 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4396 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4396 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4396 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4396 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4396 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4724 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4724 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4724 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4724 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4724 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4724 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4724 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe PID 2096 wrote to memory of 4724 2096 tmpx3vyntn0.exe tmpx3vyntn0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"2⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"2⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"2⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"2⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"C:\Users\Admin\AppData\Local\Temp\tmpx3vyntn0.exe"2⤵PID:4724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1616 -ip 16161⤵PID:4100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4564 -ip 45641⤵PID:4720