Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
29-03-2024 04:20
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.11526.16693.exe
-
Size
701KB
-
MD5
426e109b0b6192c42ce6b9746006bc92
-
SHA1
870b442fd71f37b4f68e0d72cb0ac7211b0a27d5
-
SHA256
5a2666c6e1d72ae675ade0ecbc29228224b3c631151019891e6f07ec7f5aefe8
-
SHA512
cd029dd6cda8cfaa2ba791db22032b4b4477f38b9d0a6dbde6f6e711515bff52faeb96334c03898129c7ed677f781a25088354ea107e68875f6e26ce0b989f36
-
SSDEEP
12288:R4LK1kcsw5+xVbTkWoV5wthfXMoj7XnK4nGZFNSvTIxhAGpCi1ycMtJGUDNkR:yikcsw5cV/8wPp/XK4O/J0GAi23GaQ
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.egyptian-international.com - Port:
587 - Username:
[email protected] - Password:
@@Nour60008 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.11526.16693.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.11526.16693.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.11526.16693.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.11526.16693.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2072-0-0x0000000001390000-0x000000000143C000-memory.dmpFilesize
688KB
-
memory/2072-1-0x0000000074250000-0x000000007493E000-memory.dmpFilesize
6.9MB
-
memory/2072-2-0x0000000000910000-0x0000000000950000-memory.dmpFilesize
256KB
-
memory/2072-3-0x00000000008C0000-0x00000000008DA000-memory.dmpFilesize
104KB
-
memory/2072-4-0x00000000003F0000-0x00000000003FC000-memory.dmpFilesize
48KB
-
memory/2072-5-0x00000000052E0000-0x0000000005364000-memory.dmpFilesize
528KB
-
memory/2072-19-0x0000000074250000-0x000000007493E000-memory.dmpFilesize
6.9MB
-
memory/2212-9-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2212-8-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2212-10-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2212-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2212-13-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2212-15-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2212-17-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2212-18-0x0000000074250000-0x000000007493E000-memory.dmpFilesize
6.9MB
-
memory/2212-6-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2212-20-0x00000000004F0000-0x0000000000530000-memory.dmpFilesize
256KB
-
memory/2212-21-0x0000000074250000-0x000000007493E000-memory.dmpFilesize
6.9MB
-
memory/2212-22-0x00000000004F0000-0x0000000000530000-memory.dmpFilesize
256KB