Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
06-04-2024 01:18
General
-
Target
c2fbfeaae8323cc8ca88ab7e7d2a80f4389d7d77870b560e9959fedee8b23827.exe
-
Size
87KB
-
MD5
54e3c76747e04cf98283167390e3f123
-
SHA1
a3addc3808226149381201bb24926fb8cbfff167
-
SHA256
c2fbfeaae8323cc8ca88ab7e7d2a80f4389d7d77870b560e9959fedee8b23827
-
SHA512
576c959e486aa3b4a7f3902b27f29da9eb467b8339514f00e2fc9c83c0302b62b7778457fb54043a76e7530437836822ea7e4950b10e7783a8cd06666fd1052e
-
SSDEEP
1536:oLQAJg6/L6iFQzXblXAorYfwJcxSTlWoJl0ovJvWR4jmft2Ib7ADUzqbD3htV:OJgsL66ykDxSTlWoJl0ovJvWR46fJb7m
Malware Config
Extracted
Protocol: smtp- Host:
66.29.151.236 - Port:
587 - Username:
[email protected] - Password:
KSN9T9fAXAWh
Extracted
purecrypter
http://213.199.41.33/rw/Lftspwf.pdf
Extracted
agenttesla
Protocol: smtp- Host:
66.29.151.236 - Port:
587 - Username:
[email protected] - Password:
KSN9T9fAXAWh - Email To:
[email protected]
Extracted
xworm
5.0
91.92.241.169:5353
XctZl0l6I2mIgS0k
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot5987023205:AAFlvwKv3zD3wQ2CQAewIB6uU95uBQ25ip0/sendMessage?chat_id=5202962680
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect Xworm Payload 1 IoCs
-
Detect ZGRat V1 35 IoCs
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Xworm
Xworm is a remote access trojan written in C#.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2fbfeaae8323cc8ca88ab7e7d2a80f4389d7d77870b560e9959fedee8b23827.exe"C:\Users\Admin\AppData\Local\Temp\c2fbfeaae8323cc8ca88ab7e7d2a80f4389d7d77870b560e9959fedee8b23827.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wndv.exe"C:\Users\Admin\AppData\Local\Temp\wndv.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wndv.exe"C:\Users\Admin\AppData\Local\Temp\wndv.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\c2fbfeaae8323cc8ca88ab7e7d2a80f4389d7d77870b560e9959fedee8b23827.exe"C:\Users\Admin\AppData\Local\Temp\c2fbfeaae8323cc8ca88ab7e7d2a80f4389d7d77870b560e9959fedee8b23827.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53c485da05806092761ed2c34cdf66ea8
SHA10694a1877b60e9f15508c8f1086142453d3b71b3
SHA25690cad9ea7e0a84213929adaf934daf8447f2bb99027fb90648a9d2cf0b36300e
SHA51204397f7e882aaff541d5a332260119d1468977958ae9b2f3905e98c0c20bc6cd695a3b9fe92c8f538872666417ab77c517c3543cf787ddf18bfe491c82b886cb
-
Filesize
72KB
MD5d9733d347b86d9809f36df294655852a
SHA1293993e8248ad27cf2a3f161bf3cfd64fb176a1c
SHA25638249d02586ebbfae84907ee61da7694c834828461228dc0fd3ad8c61ace30b7
SHA51276a69e6dfe5729f825b0e6a25643dab1bc5a7a515b3a638268d5b1fda8171637c766647ac9b17b8c14982f5998a78cb14d7be4b4afd218544c7d5987b5ab95cb
-
Filesize
64KB
MD5e26bec4ddca528b8f612a86afd9020e4
SHA158ef86dd5e3673ebfe8be9f64b4547d0e6f9550f
SHA256ad5711df97ba1e90d8410a5e3d76f01fd623ff0a32b38d5869396da06307b407
SHA512536f994ca825dc40e5425f242a8a23227fd945ba4600ac0919f8b806060506cf75538b7f7e0f73bea1c4e8e09698af4dad2a371895cf2078ff351db17b737d04
-
Filesize
80KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
368KB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
320KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
256KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
456KB
-
Filesize
304KB
-
Filesize
2.2MB
-
Filesize
336KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
7.7MB
-
Filesize
2.2MB
-
Filesize
96KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
2.2MB
-
Filesize
64KB
-
Filesize
7.7MB