Analysis
- max time kernel
141s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
09/01/2024, 07:01
General
- Target Ödeme makbuzu.exe
- Size 931KB
- Sample240109-hs7x9shcbj
- SHA256 516e1b54eb023601fd25f0c943fccb91dee0335c714515e2e263eb927642ebbe
Malware Config
Extracted
-
Protocol
ftp
-
Host
eu-west-1.sftpcloud.io
-
Port
21
-
Username
f27ea63fd3cd44ea9c8de4b2faa424fb
-
Password
4AOVP8idnlxzVmyt8FU3oxcJ2EfEW4R9
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://eu-west-1.sftpcloud.io
-
Port
21
-
Username
f27ea63fd3cd44ea9c8de4b2faa424fb
-
Password
4AOVP8idnlxzVmyt8FU3oxcJ2EfEW4R9
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ödeme makbuzu.exe"C:\Users\Admin\AppData\Local\Temp\Ödeme makbuzu.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ödeme makbuzu.exe"C:\Users\Admin\AppData\Local\Temp\Ödeme makbuzu.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Ödeme makbuzu.exe.log
memory/2424-10-0x00000000750D0000-0x0000000075880000-memory.dmp
memory/2424-3-0x0000000004FB0000-0x0000000005042000-memory.dmp
memory/2424-2-0x0000000005610000-0x0000000005BB4000-memory.dmp
memory/2424-4-0x0000000004F60000-0x0000000004F70000-memory.dmp
memory/2424-5-0x0000000005190000-0x000000000519A000-memory.dmp
memory/2424-6-0x00000000055F0000-0x0000000005606000-memory.dmp
memory/2424-7-0x00000000061E0000-0x00000000061EE000-memory.dmp
memory/2424-8-0x0000000007BA0000-0x0000000007C1A000-memory.dmp
memory/2424-1-0x00000000750D0000-0x0000000075880000-memory.dmp
memory/2424-9-0x000000000A300000-0x000000000A39C000-memory.dmp
memory/2424-0-0x0000000000500000-0x00000000005EE000-memory.dmp
memory/2424-16-0x00000000750D0000-0x0000000075880000-memory.dmp
memory/2424-11-0x0000000004F60000-0x0000000004F70000-memory.dmp
memory/4400-12-0x0000000000400000-0x0000000000440000-memory.dmp
memory/4400-18-0x00000000054B0000-0x0000000005516000-memory.dmp
memory/4400-17-0x00000000052F0000-0x0000000005300000-memory.dmp
memory/4400-15-0x00000000750D0000-0x0000000075880000-memory.dmp
memory/4400-19-0x0000000006190000-0x00000000061E0000-memory.dmp
memory/4400-20-0x00000000750D0000-0x0000000075880000-memory.dmp
memory/4400-21-0x00000000052F0000-0x0000000005300000-memory.dmp