Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-03-2024 03:03

General

  • Target

    f5872c6b688de34eb008a355b6d2106c2a3260f44df4747fb4eaeb26beedde08.exe

  • Size

    409KB

  • MD5

    a64f48e05fc7d21131ee7f86181413b0

  • SHA1

    5f34901b97296aa07e210810bbf75269a2701113

  • SHA256

    f5872c6b688de34eb008a355b6d2106c2a3260f44df4747fb4eaeb26beedde08

  • SHA512

    af4c41f4d6da19ef88b037ba8498057e5bff7460b4c7abc604652898ed775dc547e06627618d422e6f3396b7dbb6a9388f5db46c56d08dabf02b3df5e5355ff4

  • SSDEEP

    1536:jxGspx6tjTBchm0hOrtHhYJu6RlXKd+8kGoY5arTKyAWNHRjmz+4H444lM:1LUzAetBeW+8kGP5arTKyjxh4H444lM

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6359093814:AAF_EjsxYKPM2ufeJYS89EiAg_4CPa-HNlM/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect ZGRat V1 34 IoCs
  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

  • PureLog Stealer payload 2 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f5872c6b688de34eb008a355b6d2106c2a3260f44df4747fb4eaeb26beedde08.exe
    "C:\Users\Admin\AppData\Local\Temp\f5872c6b688de34eb008a355b6d2106c2a3260f44df4747fb4eaeb26beedde08.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1888
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      2⤵
        PID:4080
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1416

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1416-4792-0x00000000751A0000-0x0000000075950000-memory.dmp

      Filesize

      7.7MB

    • memory/1416-4794-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/1416-4795-0x0000000004E90000-0x0000000004EA0000-memory.dmp

      Filesize

      64KB

    • memory/1416-4796-0x0000000004E20000-0x0000000004E86000-memory.dmp

      Filesize

      408KB

    • memory/1416-4797-0x0000000005C50000-0x0000000005CA0000-memory.dmp

      Filesize

      320KB

    • memory/1416-4800-0x0000000005CC0000-0x0000000005CCA000-memory.dmp

      Filesize

      40KB

    • memory/1416-4799-0x0000000005EE0000-0x0000000005F72000-memory.dmp

      Filesize

      584KB

    • memory/1416-4798-0x0000000005D40000-0x0000000005DDC000-memory.dmp

      Filesize

      624KB

    • memory/1888-36-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-46-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-5-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-6-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-8-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-10-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-12-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-14-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-16-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-18-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-20-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-22-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-24-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-26-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-28-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-30-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-32-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-34-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-3-0x0000000002390000-0x0000000002396000-memory.dmp

      Filesize

      24KB

    • memory/1888-38-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-40-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-42-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-44-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-4-0x0000000005650000-0x0000000005876000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-48-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-50-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-52-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-54-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-56-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-58-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-60-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-62-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-64-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-66-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-68-0x0000000005650000-0x0000000005871000-memory.dmp

      Filesize

      2.1MB

    • memory/1888-93-0x00000000751A0000-0x0000000075950000-memory.dmp

      Filesize

      7.7MB

    • memory/1888-310-0x0000000004A80000-0x0000000004A90000-memory.dmp

      Filesize

      64KB

    • memory/1888-4785-0x0000000000500000-0x0000000000501000-memory.dmp

      Filesize

      4KB

    • memory/1888-4786-0x0000000000A20000-0x0000000000A8C000-memory.dmp

      Filesize

      432KB

    • memory/1888-2-0x0000000004A80000-0x0000000004A90000-memory.dmp

      Filesize

      64KB

    • memory/1888-1-0x00000000000B0000-0x000000000011C000-memory.dmp

      Filesize

      432KB

    • memory/1888-0-0x00000000751A0000-0x0000000075950000-memory.dmp

      Filesize

      7.7MB

    • memory/1888-4787-0x00000000007A0000-0x00000000007EC000-memory.dmp

      Filesize

      304KB

    • memory/1888-4788-0x00000000070D0000-0x0000000007674000-memory.dmp

      Filesize

      5.6MB

    • memory/1888-4789-0x0000000000AA0000-0x0000000000AF4000-memory.dmp

      Filesize

      336KB

    • memory/1888-4793-0x00000000751A0000-0x0000000075950000-memory.dmp

      Filesize

      7.7MB