Analysis
- max time kernel
157s - max time network
162s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
13/03/2024, 02:49
General
- Target e837bf6c58ee97ebdb7c3d58a733f3d527bf0150f1eb551af6707f71d54a3457.exe
- Size 481KB
- Sample240313-dbe4psba6w
- SHA256 e837bf6c58ee97ebdb7c3d58a733f3d527bf0150f1eb551af6707f71d54a3457
Malware Config
Extracted
-
Protocol
smtp
-
Host
66.29.151.236
-
Port
587
-
Username
-
Password
moIynCqPXDmd
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
66.29.151.236
-
Port
587
-
Username
-
Password
moIynCqPXDmd
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect ZGRat V1 35 IoCs
- PureLog Stealer
PureLog Stealer is an infostealer written in C#.
- PureLog Stealer payload 2 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
- Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
- Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
- Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e837bf6c58ee97ebdb7c3d58a733f3d527bf0150f1eb551af6707f71d54a3457.exe"C:\Users\Admin\AppData\Local\Temp\e837bf6c58ee97ebdb7c3d58a733f3d527bf0150f1eb551af6707f71d54a3457.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fel.exe"C:\Users\Admin\AppData\Local\Temp\fel.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpA330.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA330.tmp.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\e837bf6c58ee97ebdb7c3d58a733f3d527bf0150f1eb551af6707f71d54a3457.exeC:\Users\Admin\AppData\Local\Temp\e837bf6c58ee97ebdb7c3d58a733f3d527bf0150f1eb551af6707f71d54a3457.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
e837bf6c58ee97ebdb7c3d58a733f3d527bf0150f1eb551af6707f71d54a3457.exe.log
fel.exe
tmpA330.tmp.exe
memory/60-66-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-1138-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/60-5-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-6-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-8-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-10-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-12-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-14-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-16-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-18-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-20-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-22-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-24-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-26-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-28-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-30-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-32-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-34-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-36-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-38-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-40-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-42-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-44-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-46-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-48-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-50-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-52-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-54-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-56-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-58-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-60-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-62-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-64-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-1614-0x0000000005450000-0x0000000005460000-memory.dmp
memory/60-4-0x0000000005E60000-0x0000000006060000-memory.dmp
memory/60-68-0x0000000005E60000-0x000000000605B000-memory.dmp
memory/60-0-0x0000000000910000-0x000000000098C000-memory.dmp
memory/60-4783-0x0000000000E20000-0x0000000000E21000-memory.dmp
memory/60-4785-0x00000000012A0000-0x00000000012EC000-memory.dmp
memory/60-4784-0x0000000000F90000-0x0000000000FD8000-memory.dmp
memory/60-3-0x0000000002E30000-0x0000000002E3A000-memory.dmp
memory/60-1-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/60-4798-0x0000000006D40000-0x00000000072E4000-memory.dmp
memory/60-4807-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/60-2-0x0000000005450000-0x0000000005460000-memory.dmp
memory/828-4824-0x0000000002F80000-0x0000000002F8A000-memory.dmp
memory/828-9614-0x00000000062F0000-0x00000000063BE000-memory.dmp
memory/828-9613-0x0000000001270000-0x0000000001271000-memory.dmp
memory/828-5800-0x0000000005660000-0x0000000005670000-memory.dmp
memory/828-4827-0x0000000005660000-0x0000000005670000-memory.dmp
memory/828-4830-0x0000000005FB0000-0x0000000006236000-memory.dmp
memory/828-4826-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/828-5587-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/828-4823-0x0000000000D20000-0x0000000000D9C000-memory.dmp
memory/4232-4809-0x0000000005840000-0x00000000058A6000-memory.dmp
memory/4232-4916-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/4232-4806-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4232-4808-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/4232-4828-0x0000000006EF0000-0x0000000006F40000-memory.dmp
memory/4232-4829-0x0000000006FE0000-0x000000000707C000-memory.dmp
memory/4232-4810-0x00000000057C0000-0x00000000057D0000-memory.dmp
memory/4232-5140-0x00000000057C0000-0x00000000057D0000-memory.dmp
memory/4232-5006-0x0000000007080000-0x0000000007112000-memory.dmp
memory/4232-5011-0x0000000006F80000-0x0000000006F8A000-memory.dmp
memory/4316-4825-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/4316-4799-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/4316-4797-0x0000000000110000-0x0000000000120000-memory.dmp
memory/4316-4803-0x0000000004A50000-0x0000000004A56000-memory.dmp
memory/4316-4800-0x0000000004A70000-0x0000000004A80000-memory.dmp