Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
05-12-2023 09:53
Static task
static1
Behavioral task
behavioral1
Sample
africpiou.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
africpiou.exe
Resource
win10v2004-20231130-en
General
-
Target
africpiou.exe
-
Size
331KB
-
MD5
cb407edd867bb298d86ad82c2b4e7032
-
SHA1
2efcca5f28ccb1926ac128e5197839f13af01983
-
SHA256
f4cf2a5eba5104f17dcadf06a03a269157bfe9bb726c4bf0291519f47c2736f2
-
SHA512
1dd3ec12a42d1d898dce05cee613e80aca2b3190561f6ccf38569e9feee5a9d48ae0fd6439d4a2c4754c2c48146c37d6fbcf46543d189939e89ddfaa0adcf106
-
SSDEEP
6144:fGS74D4ji0736hkiSMCbGc1mqF32UiYRcENIysJGlq2a+gC0Noe+ek:eS0j0736ufEcsmL1cE25JGlq2aDrW
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6669461375:AAGwrSGDuGS4lzGe3ziI4ubZc9TzQ8r1m8o/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
africpiou.exedescription pid process target process PID 2376 set thread context of 2608 2376 africpiou.exe africpiou.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
africpiou.exepid process 2608 africpiou.exe 2608 africpiou.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
africpiou.exedescription pid process Token: SeDebugPrivilege 2608 africpiou.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
africpiou.exedescription pid process target process PID 2376 wrote to memory of 2608 2376 africpiou.exe africpiou.exe PID 2376 wrote to memory of 2608 2376 africpiou.exe africpiou.exe PID 2376 wrote to memory of 2608 2376 africpiou.exe africpiou.exe PID 2376 wrote to memory of 2608 2376 africpiou.exe africpiou.exe PID 2376 wrote to memory of 2608 2376 africpiou.exe africpiou.exe PID 2376 wrote to memory of 2608 2376 africpiou.exe africpiou.exe PID 2376 wrote to memory of 2608 2376 africpiou.exe africpiou.exe PID 2376 wrote to memory of 2608 2376 africpiou.exe africpiou.exe PID 2376 wrote to memory of 2608 2376 africpiou.exe africpiou.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\africpiou.exe"C:\Users\Admin\AppData\Local\Temp\africpiou.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\africpiou.exe"C:\Users\Admin\AppData\Local\Temp\africpiou.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608