Analysis
- max time kernel
142s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
18/12/2023, 17:34
General
- Target SOA.exe
- Size 375KB
- Sample231218-v5ehpsdeb3
- SHA256 3934d48c77cb712a0ee30371d372b3198f60e6e90b79d93dca8c972640e889c8
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.karthikagro.in
-
Port
587
-
Username
-
Password
Yenks@0910
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Executes dropped EXE 2 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"C:\Users\Admin\AppData\Local\Temp\SOA.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rydaehv.exe"C:\Users\Admin\AppData\Local\Temp\rydaehv.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rydaehv.exe"C:\Users\Admin\AppData\Local\Temp\rydaehv.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
dkgerawve.n
rydaehv.exe
memory/2704-15-0x0000000004E80000-0x0000000004E90000-memory.dmp
memory/2704-16-0x0000000005440000-0x00000000059E4000-memory.dmp
memory/2704-9-0x0000000000400000-0x0000000000453000-memory.dmp
memory/2704-10-0x0000000000400000-0x0000000000453000-memory.dmp
memory/2704-11-0x0000000000400000-0x0000000000453000-memory.dmp
memory/2704-12-0x0000000004C90000-0x0000000004CD2000-memory.dmp
memory/2704-13-0x0000000073FE0000-0x0000000074790000-memory.dmp
memory/2704-14-0x0000000004E80000-0x0000000004E90000-memory.dmp
memory/2704-24-0x0000000004E80000-0x0000000004E90000-memory.dmp
memory/2704-7-0x0000000000400000-0x0000000000453000-memory.dmp
memory/2704-17-0x0000000004E00000-0x0000000004E66000-memory.dmp
memory/2704-18-0x0000000006350000-0x00000000063A0000-memory.dmp
memory/2704-19-0x0000000006440000-0x00000000064DC000-memory.dmp
memory/2704-20-0x0000000073FE0000-0x0000000074790000-memory.dmp
memory/2704-21-0x0000000006580000-0x0000000006612000-memory.dmp
memory/2704-22-0x0000000006520000-0x000000000652A000-memory.dmp
memory/2704-23-0x0000000004E80000-0x0000000004E90000-memory.dmp
memory/2712-5-0x00000000001F0000-0x00000000001F2000-memory.dmp