Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
11-12-2023 11:18
General
-
Target
SecuriteInfo.com.Trojan.GenericKD.65594079.25944.10510.exe
-
Size
1.5MB
-
MD5
ee0a61b47e6676cce5c6908cfe8d9f98
-
SHA1
a7636fc89e3e076b1e8bdc2fa7b3ae3f7ba126c2
-
SHA256
be1e625483202184962d61f45c1c31c00a18063376a91ce7bae5ed72169d05f2
-
SHA512
cc644964da0fa26bcdfc5d92aedb6527e098fd19bbb40308df6c16b5df9aebbd5f463a59285a19081915d08dbedeedf90adda0ebcf59902ec8117777cdf2ff72
-
SSDEEP
24576:zU3iOHs23wM460Q9kB1dExumukxUhj4oEjqFzqMAxHbQaHhizTM8T6H:A3K8wVWe0NUhkoEjqFztAxhN46H
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.bilbonne.com - Port:
587 - Username:
[email protected] - Password:
YuKPdqG2
Extracted
rhadamanthys
http://212.193.30.32/upload/libcurl.dll
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect rhadamanthys stealer shellcode 3 IoCs
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 50 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\SysWOW64\fontview.exe"C:\Windows\SYSWOW64\fontview.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.65594079.25944.10510.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.65594079.25944.10510.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 5762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 5682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4432 -ip 44321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4432 -ip 44321⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
334KB
MD58596736c157f4e9d597e640b5fd272c2
SHA152c13d50177761027cf834200909cb8871e2bfc0
SHA2567788d59ce9a3935ac67aadd1d6da93feb8a6c2c4ee8b53fba51b93a8f42b3a7a
SHA512ceb67ced3657617fbe6485642e92c44e672fc39f4c1770a92323bccee636aebeea3b788b9297787db1bb0945e194f2aa245e7f02743207577eca160488ca7d37
-
Filesize
8KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
112KB
-
Filesize
1024KB
-
Filesize
112KB
-
Filesize
204KB
-
Filesize
16.0MB
-
Filesize
204KB
-
Filesize
112KB
-
Filesize
1.3MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.3MB
-
Filesize
408KB
-
Filesize
40KB
-
Filesize
96KB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
240KB
-
Filesize
320KB
-
Filesize
240KB
-
Filesize
584KB