Analysis
- max time kernel
139s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
03/04/2024, 12:58
General
- Target RFQ-QR240402-240326-0419-Submittal For Abu Dhabi Gas Expansion Project.exe
- Size 2.6MB
- Sample240403-p7p5bsdg89
- SHA256 3ec62b11f0829ce174350aa19fd9ec005284590b23128c56acd7195a4c02e028
Malware Config
Extracted
-
agenttesla
-
https://api.telegram.org/bot6582772005:AAHO4UgG3E84ONMX2K1jJflNFqS5gafHxtw/
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect ZGRat V1 34 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ-QR240402-240326-0419-Submittal For Abu Dhabi Gas Expansion Project.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-QR240402-240326-0419-Submittal For Abu Dhabi Gas Expansion Project.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ-QR240402-240326-0419-Submittal For Abu Dhabi Gas Expansion Project.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-QR240402-240326-0419-Submittal For Abu Dhabi Gas Expansion Project.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
RFQ-QR240402-240326-0419-Submittal For Abu Dhabi Gas Expansion Project.exe.log
memory/1328-1-0x00000000008D0000-0x0000000000B7C000-memory.dmp
memory/1328-0-0x0000000075380000-0x0000000075B30000-memory.dmp
memory/1328-2-0x00000000057C0000-0x00000000059F2000-memory.dmp
memory/1328-3-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-4-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-6-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-8-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-10-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-12-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-14-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-16-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-20-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-22-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-18-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-24-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-28-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-26-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-30-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-32-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-36-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-38-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-42-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-44-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-40-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-46-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-34-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-48-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-50-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-52-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-54-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-58-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-56-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-62-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-60-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-64-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-66-0x00000000057C0000-0x00000000059EB000-memory.dmp
memory/1328-3613-0x0000000075380000-0x0000000075B30000-memory.dmp
memory/1328-4884-0x00000000057B0000-0x00000000057C0000-memory.dmp
memory/1328-4885-0x0000000005790000-0x0000000005791000-memory.dmp
memory/1328-4886-0x0000000005C00000-0x0000000005C6C000-memory.dmp
memory/1328-4887-0x0000000005D70000-0x0000000005DBC000-memory.dmp
memory/1328-4888-0x00000000065C0000-0x0000000006B64000-memory.dmp
memory/1328-4889-0x0000000005E40000-0x0000000005E94000-memory.dmp
memory/1328-4893-0x0000000075380000-0x0000000075B30000-memory.dmp
memory/4932-4895-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4932-4894-0x0000000075380000-0x0000000075B30000-memory.dmp
memory/4932-4896-0x00000000056D0000-0x00000000056E0000-memory.dmp
memory/4932-4897-0x00000000056E0000-0x0000000005746000-memory.dmp
memory/4932-4898-0x0000000006D80000-0x0000000006E12000-memory.dmp
memory/4932-4899-0x0000000006E20000-0x0000000006E70000-memory.dmp
memory/4932-4900-0x0000000006F10000-0x0000000006FAC000-memory.dmp
memory/4932-4901-0x00000000070F0000-0x00000000070FA000-memory.dmp
memory/4932-4902-0x0000000075380000-0x0000000075B30000-memory.dmp
memory/4932-4903-0x00000000056D0000-0x00000000056E0000-memory.dmp