Analysis

  • max time kernel
    140s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-03-2024 01:03

General

  • Target

    eb18c1fdf1c1f4360d3de340f309a2e3a991d67273d4bb72297797c731eeec35.exe

  • Size

    481KB

  • MD5

    c4db22e342217e2d4a81fd7b023b7028

  • SHA1

    b91ce461be008ec24faf2c0d72ad90e78567b82a

  • SHA256

    eb18c1fdf1c1f4360d3de340f309a2e3a991d67273d4bb72297797c731eeec35

  • SHA512

    862b0e1718bcad58cb7406caa21de1b6933775d344cb566bc21c191810fb803a3fe019ac8032456a7003d5a5431ef18871f9d4ce477326bff2b70b81a47cb0b5

  • SSDEEP

    6144:+Jt8tGAKfaFmS9q1izbKM94xkw+DR/6hb4Wx+7tS6OKIBGNLUY2yYBBndN3MVqRZ:+b8tHm+6xkwKRS5+4GNl8B93MB+

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    66.29.151.236
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    DRaa8A9L3DVc

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect ZGRat V1 35 IoCs
  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

  • PureLog Stealer payload 2 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb18c1fdf1c1f4360d3de340f309a2e3a991d67273d4bb72297797c731eeec35.exe
    "C:\Users\Admin\AppData\Local\Temp\eb18c1fdf1c1f4360d3de340f309a2e3a991d67273d4bb72297797c731eeec35.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Users\Admin\AppData\Local\Temp\fel.exe
      "C:\Users\Admin\AppData\Local\Temp\fel.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Users\Admin\AppData\Local\Temp\tmpEE77.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmpEE77.tmp.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1260
        • C:\Users\Admin\AppData\Local\Temp\tmpEE77.tmp.exe
          C:\Users\Admin\AppData\Local\Temp\tmpEE77.tmp.exe
          4⤵
          • Executes dropped EXE
          PID:3484
        • C:\Users\Admin\AppData\Local\Temp\tmpEE77.tmp.exe
          C:\Users\Admin\AppData\Local\Temp\tmpEE77.tmp.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of AdjustPrivilegeToken
          PID:1696
    • C:\Users\Admin\AppData\Local\Temp\eb18c1fdf1c1f4360d3de340f309a2e3a991d67273d4bb72297797c731eeec35.exe
      C:\Users\Admin\AppData\Local\Temp\eb18c1fdf1c1f4360d3de340f309a2e3a991d67273d4bb72297797c731eeec35.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\eb18c1fdf1c1f4360d3de340f309a2e3a991d67273d4bb72297797c731eeec35.exe.log

    Filesize

    1KB

    MD5

    c3941d9fa38f1717d5cecd7a2ca71667

    SHA1

    33b5362675383b58b4166ed9f9a61e5aa6768d2e

    SHA256

    f1ed6ff1cd3df219061e32df1c75d6f48de6484cf50e5ea7d86cd8bcfcb93256

    SHA512

    98f103ef97d32bf8c0566a6f6da5cf8d58d18f698c1b3e5bd0be0ea8462f5fe54c2e5e6b5188f2b7d8f70082ffd6745b1f7f6cab95af474e2b7eaed50a9d9c45

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tmpEE77.tmp.exe.log

    Filesize

    1KB

    MD5

    435e0068bcb9090064eedccd2e18bfca

    SHA1

    9329bc444452d8ac807b085e0428b159e8eed352

    SHA256

    5721053800850afc4469bf2d079768d6d3444c6cb64394978830355ec1babdc6

    SHA512

    6c26cac18fff415ce13c12cef4656596b32d41d918c34419e39de16b27fecd4c4c912301c2293bb9c101df41ebf08a996fa26c2460c5934c5de44f01f8aab9f6

  • C:\Users\Admin\AppData\Local\Temp\fel.exe

    Filesize

    35KB

    MD5

    b47c31e89b4cacc864b6279983b4ffc3

    SHA1

    b082036aa2adb45f2db952d8dcd200fe766cf3cf

    SHA256

    34109344250f9884f7414b7d31de4f6627d4378e0723446fa836b18b60e8ed84

    SHA512

    d4febd99d7a9c554aa091ba2a03508bfefcd27ae33f04920865b3802cddcdb1960001acbcb5fab8cf61dc7a1427158b432ffa1c47d377e9417377635a15c994e

  • C:\Users\Admin\AppData\Local\Temp\tmpEE77.tmp.exe

    Filesize

    481KB

    MD5

    3a44104fb5d035d1cd725732e94a5e8d

    SHA1

    cb3f89df88e1468bca9d5ca01d22588791884ecb

    SHA256

    dcb623cc7f3f21e92e4878c82ce79582fdf6ba1e5e0c76f19097d1496e6c4b08

    SHA512

    eebe4acc924ef0284d7303ae581d29e67f1f2c23042b3a42e37b3bccedc28d10e3370a4221a95dd07c6d930d5bfae606de3a954f625f13a0eedc2eca8921acc1

  • memory/1260-6985-0x00000000749D0000-0x0000000075180000-memory.dmp

    Filesize

    7.7MB

  • memory/1260-4823-0x0000000002FB0000-0x0000000002FBA000-memory.dmp

    Filesize

    40KB

  • memory/1260-9612-0x00000000062B0000-0x00000000062B1000-memory.dmp

    Filesize

    4KB

  • memory/1260-9620-0x00000000749D0000-0x0000000075180000-memory.dmp

    Filesize

    7.7MB

  • memory/1260-9613-0x00000000064C0000-0x000000000658E000-memory.dmp

    Filesize

    824KB

  • memory/1260-7308-0x0000000005710000-0x0000000005720000-memory.dmp

    Filesize

    64KB

  • memory/1260-4821-0x0000000000D50000-0x0000000000DCC000-memory.dmp

    Filesize

    496KB

  • memory/1260-4829-0x0000000005FE0000-0x0000000006266000-memory.dmp

    Filesize

    2.5MB

  • memory/1260-4824-0x00000000749D0000-0x0000000075180000-memory.dmp

    Filesize

    7.7MB

  • memory/1260-4826-0x0000000005710000-0x0000000005720000-memory.dmp

    Filesize

    64KB

  • memory/1568-5258-0x0000000007110000-0x000000000711A000-memory.dmp

    Filesize

    40KB

  • memory/1568-4827-0x0000000006F70000-0x0000000006FC0000-memory.dmp

    Filesize

    320KB

  • memory/1568-4828-0x0000000007060000-0x00000000070FC000-memory.dmp

    Filesize

    624KB

  • memory/1568-5256-0x00000000071A0000-0x0000000007232000-memory.dmp

    Filesize

    584KB

  • memory/1568-6316-0x00000000749D0000-0x0000000075180000-memory.dmp

    Filesize

    7.7MB

  • memory/1568-4809-0x00000000058F0000-0x0000000005956000-memory.dmp

    Filesize

    408KB

  • memory/1568-4808-0x00000000059E0000-0x00000000059F0000-memory.dmp

    Filesize

    64KB

  • memory/1568-4807-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/1568-4805-0x00000000749D0000-0x0000000075180000-memory.dmp

    Filesize

    7.7MB

  • memory/1568-6644-0x00000000059E0000-0x00000000059F0000-memory.dmp

    Filesize

    64KB

  • memory/1696-34-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-4806-0x00000000749D0000-0x0000000075180000-memory.dmp

    Filesize

    7.7MB

  • memory/1696-46-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-48-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-50-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-52-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-54-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-56-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-58-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-60-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-62-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-64-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-66-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-68-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-2241-0x00000000749D0000-0x0000000075180000-memory.dmp

    Filesize

    7.7MB

  • memory/1696-2930-0x0000000005A20000-0x0000000005A30000-memory.dmp

    Filesize

    64KB

  • memory/1696-4783-0x00000000066C0000-0x00000000066C1000-memory.dmp

    Filesize

    4KB

  • memory/1696-4784-0x00000000067E0000-0x0000000006828000-memory.dmp

    Filesize

    288KB

  • memory/1696-4785-0x0000000006830000-0x000000000687C000-memory.dmp

    Filesize

    304KB

  • memory/1696-42-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-4798-0x00000000073C0000-0x0000000007964000-memory.dmp

    Filesize

    5.6MB

  • memory/1696-10475-0x00000000749D0000-0x0000000075180000-memory.dmp

    Filesize

    7.7MB

  • memory/1696-10473-0x0000000005060000-0x00000000050B6000-memory.dmp

    Filesize

    344KB

  • memory/1696-10472-0x0000000004E90000-0x0000000004E91000-memory.dmp

    Filesize

    4KB

  • memory/1696-40-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-38-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-36-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-44-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-0-0x0000000000FA0000-0x000000000101C000-memory.dmp

    Filesize

    496KB

  • memory/1696-32-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-30-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-28-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-26-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-22-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-1-0x00000000749D0000-0x0000000075180000-memory.dmp

    Filesize

    7.7MB

  • memory/1696-24-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-20-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-18-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-16-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-14-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-12-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-10-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-8-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-6-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-5-0x0000000006370000-0x000000000656A000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-4-0x0000000006370000-0x0000000006570000-memory.dmp

    Filesize

    2.0MB

  • memory/1696-3-0x00000000018A0000-0x00000000018AA000-memory.dmp

    Filesize

    40KB

  • memory/1696-2-0x0000000005A20000-0x0000000005A30000-memory.dmp

    Filesize

    64KB

  • memory/1696-9619-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/1696-9622-0x0000000004EE0000-0x0000000004FA4000-memory.dmp

    Filesize

    784KB

  • memory/1696-9623-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

    Filesize

    64KB

  • memory/1696-9621-0x00000000749D0000-0x0000000075180000-memory.dmp

    Filesize

    7.7MB

  • memory/3068-4825-0x00000000749D0000-0x0000000075180000-memory.dmp

    Filesize

    7.7MB

  • memory/3068-4802-0x0000000003130000-0x0000000003136000-memory.dmp

    Filesize

    24KB

  • memory/3068-4799-0x00000000749D0000-0x0000000075180000-memory.dmp

    Filesize

    7.7MB

  • memory/3068-4797-0x0000000000D80000-0x0000000000D90000-memory.dmp

    Filesize

    64KB