Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2024, 12:39

General

  • Target

    980041bd4d6d52fe31e571a496db18bf9bebc87791b5624d8b71c1a2acfab9b2.exe

  • Size

    328KB

  • MD5

    f79cae4a108b6f62b2b186274a62e195

  • SHA1

    742e5b643fb3ff6e5f3e7e57d4a44ed851b5f9ef

  • SHA256

    980041bd4d6d52fe31e571a496db18bf9bebc87791b5624d8b71c1a2acfab9b2

  • SHA512

    250c80a04648ed5de882eb9a15735218058185c50dc6854bf5955003d88120d2f28c888cd39ee2e085bfd01d1e2a6d499a07eb6a39905ef42d60c1d35fdaf3eb

  • SSDEEP

    6144:YTtn00UPXQhvsSt/okvbxIYWXDGemuHR2buxa/vlygAi:YTt18IvsM/omSpGelHR2yxkly

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\980041bd4d6d52fe31e571a496db18bf9bebc87791b5624d8b71c1a2acfab9b2.exe
    "C:\Users\Admin\AppData\Local\Temp\980041bd4d6d52fe31e571a496db18bf9bebc87791b5624d8b71c1a2acfab9b2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3200
    • C:\Users\Admin\AppData\Local\Temp\980041bd4d6d52fe31e571a496db18bf9bebc87791b5624d8b71c1a2acfab9b2.exe
      "C:\Users\Admin\AppData\Local\Temp\980041bd4d6d52fe31e571a496db18bf9bebc87791b5624d8b71c1a2acfab9b2.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2320

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\980041bd4d6d52fe31e571a496db18bf9bebc87791b5624d8b71c1a2acfab9b2.exe.log

          Filesize

          42B

          MD5

          84cfdb4b995b1dbf543b26b86c863adc

          SHA1

          d2f47764908bf30036cf8248b9ff5541e2711fa2

          SHA256

          d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

          SHA512

          485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

        • memory/2320-14-0x0000000005FF0000-0x000000000608C000-memory.dmp

          Filesize

          624KB

        • memory/2320-13-0x0000000005F00000-0x0000000005F50000-memory.dmp

          Filesize

          320KB

        • memory/2320-4-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/2320-18-0x0000000006350000-0x000000000635A000-memory.dmp

          Filesize

          40KB

        • memory/2320-17-0x0000000006370000-0x0000000006402000-memory.dmp

          Filesize

          584KB

        • memory/2320-16-0x0000000004F50000-0x0000000004F60000-memory.dmp

          Filesize

          64KB

        • memory/2320-15-0x0000000074F00000-0x00000000756B0000-memory.dmp

          Filesize

          7.7MB

        • memory/2320-11-0x0000000004F50000-0x0000000004F60000-memory.dmp

          Filesize

          64KB

        • memory/2320-10-0x0000000004FD0000-0x0000000005036000-memory.dmp

          Filesize

          408KB

        • memory/2320-9-0x0000000005510000-0x0000000005AB4000-memory.dmp

          Filesize

          5.6MB

        • memory/2320-8-0x0000000074F00000-0x00000000756B0000-memory.dmp

          Filesize

          7.7MB

        • memory/3200-0-0x0000000000C30000-0x0000000000C88000-memory.dmp

          Filesize

          352KB

        • memory/3200-2-0x0000000005550000-0x0000000005560000-memory.dmp

          Filesize

          64KB

        • memory/3200-7-0x0000000074F00000-0x00000000756B0000-memory.dmp

          Filesize

          7.7MB

        • memory/3200-1-0x0000000074F00000-0x00000000756B0000-memory.dmp

          Filesize

          7.7MB

        • memory/3200-3-0x0000000001800000-0x0000000001801000-memory.dmp

          Filesize

          4KB