General

  • Target

    765624605.eml

  • Size

    861KB

  • Sample

    240329-hfz2wsbg7w

  • MD5

    e26b9812a7b4d5aae87202ea823aecdf

  • SHA1

    eeec15fb46b5241824719b251d33de5eef25eb47

  • SHA256

    cd6e356108f85593417f15f75f1f591bdab7626614d5949a8542ef6463c579b3

  • SHA512

    51d69106657b97d88d0081c2e0418d0e48b00afed141d02e75d3a763e9a4b154dd8b67b991d61c18286994ca04ca0f8ca95fc830e6838dc549607bb0e1423bcf

  • SSDEEP

    24576:hIYSiWWMZvCII4EH341l3VajtvjD+cQlwm:2YS5BZqI19wuqm

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.gimpex-imerys.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    h45ZVRb6(IMF

Targets

    • Target

      Template.exe

    • Size

      631KB

    • MD5

      bb92e7ea4ed8993efb04232cc975d775

    • SHA1

      ccacb5da9959a4430ae0bdc8d9609bd895000214

    • SHA256

      bff6dd069ce9b075dbd570110617371790145b8d948439ccce8603e607491a01

    • SHA512

      3ac5eb5aaeeacc94436349be3b77d3ec16f296748da1bab056c49d493e1585a4374cd22e680701ea68221bdf4ebe49437bd727bf0272221cce78790f9b15bacb

    • SSDEEP

      12288:IDWNWxTMYFUaVPOjScfwqFeZp/rpPBj34id8zlqw7ZTv:I6NWxTMBaV25OZpdBqV

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Credential Access

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

4
T1005

Tasks