Analysis

  • max time kernel
    116s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2024, 12:14

General

  • Target

    INVOICE-BUO2300000.exe

  • Size

    774KB

  • MD5

    aca3eeaff7c67d96a626259d3d73a20f

  • SHA1

    cfe7c18b3c77c968e0c4dde45072b3771dfe9ad0

  • SHA256

    da6f3f1f642c13d2b7bf4c86e2686c5e1b606dbe0838423998c15742940545e9

  • SHA512

    c406f0d0be44f329237040f163988b82aa83f94aad6fb88500ac4d54fd6f4739031ed7954a0b7ef4d07df488730e20f9ddeebbb44725e16180f97ee08e3e4b4f

  • SSDEEP

    12288:Yefdsbuw0Wa95Em6E3/+Bpglgh+zIGznQNVZCJ/dzpTt+bwSKu:qU3B/Bo+z/+VO

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.ipr-co.org
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    IPRco@100102@

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\INVOICE-BUO2300000.exe
    "C:\Users\Admin\AppData\Local\Temp\INVOICE-BUO2300000.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Users\Admin\AppData\Local\Temp\INVOICE-BUO2300000.exe
      "C:\Users\Admin\AppData\Local\Temp\INVOICE-BUO2300000.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3612
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2352 --field-trial-handle=2232,i,11267738607351977302,107266978269557304,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3748

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\INVOICE-BUO2300000.exe.log

            Filesize

            1KB

            MD5

            8ec831f3e3a3f77e4a7b9cd32b48384c

            SHA1

            d83f09fd87c5bd86e045873c231c14836e76a05c

            SHA256

            7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

            SHA512

            26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

          • memory/2044-8-0x0000000009FE0000-0x000000000A062000-memory.dmp

            Filesize

            520KB

          • memory/2044-1-0x0000000074BE0000-0x0000000075390000-memory.dmp

            Filesize

            7.7MB

          • memory/2044-3-0x0000000007630000-0x00000000076C2000-memory.dmp

            Filesize

            584KB

          • memory/2044-4-0x0000000007860000-0x0000000007870000-memory.dmp

            Filesize

            64KB

          • memory/2044-5-0x00000000077C0000-0x00000000077CA000-memory.dmp

            Filesize

            40KB

          • memory/2044-6-0x0000000007970000-0x0000000007980000-memory.dmp

            Filesize

            64KB

          • memory/2044-7-0x00000000087F0000-0x00000000087FC000-memory.dmp

            Filesize

            48KB

          • memory/2044-0-0x00000000006F0000-0x00000000007B6000-memory.dmp

            Filesize

            792KB

          • memory/2044-2-0x0000000007B40000-0x00000000080E4000-memory.dmp

            Filesize

            5.6MB

          • memory/2044-9-0x0000000006340000-0x00000000063DC000-memory.dmp

            Filesize

            624KB

          • memory/2044-14-0x0000000074BE0000-0x0000000075390000-memory.dmp

            Filesize

            7.7MB

          • memory/3612-13-0x0000000074BE0000-0x0000000075390000-memory.dmp

            Filesize

            7.7MB

          • memory/3612-15-0x0000000005940000-0x0000000005950000-memory.dmp

            Filesize

            64KB

          • memory/3612-10-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/3612-16-0x0000000005880000-0x00000000058E6000-memory.dmp

            Filesize

            408KB

          • memory/3612-17-0x00000000066B0000-0x0000000006700000-memory.dmp

            Filesize

            320KB

          • memory/3612-18-0x0000000074BE0000-0x0000000075390000-memory.dmp

            Filesize

            7.7MB

          • memory/3612-19-0x0000000005940000-0x0000000005950000-memory.dmp

            Filesize

            64KB