Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06-04-2024 08:49
Static task
static1
Behavioral task
behavioral1
Sample
Document_BT24PDF.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Document_BT24PDF.exe
Resource
win10v2004-20240226-en
General
-
Target
Document_BT24PDF.exe
-
Size
822KB
-
MD5
7c1be3bb77ce7fecad1e6d142db95fbf
-
SHA1
63c170cebb0e1ad1104897e8837bf14eb5c08cbd
-
SHA256
187cdd0639eb10e50f060de4cb487920a65628104f66a0aeb12c5404a55fe298
-
SHA512
74df0f90d3d92bd0993e4d519105d327c725cf4c10bddb57cbf6a87f10cd7ef2081830813d3ca2b3a9c80560f67808b13d7c5d3c24535d1ed4f45b4ceb9037f2
-
SSDEEP
12288:mecSSWLU423D7R+5vmVfa4NQDOYyTjTtmJzOHZ+vuF1HXSQoro36nzhdGjKqAXzC:4zWL67R+unuDJ+ssHgu7CQoW6NGqmIS
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.hdconstruct.ro/ - Port:
21 - Username:
[email protected] - Password:
5R)XZ2Xqis2HZ7p[d6+Oe!0i^C85CQ]uD68jNN@ossy~wH-(ie^9O2(001174?skX%ouFto
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3988-15-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/3340-7-0x0000000005770000-0x0000000005798000-memory.dmp agile_net -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Document_BT24PDF.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Document_BT24PDF.exe Key opened \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Document_BT24PDF.exe Key opened \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Document_BT24PDF.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Document_BT24PDF.exedescription pid process target process PID 3340 set thread context of 3988 3340 Document_BT24PDF.exe Document_BT24PDF.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Document_BT24PDF.exeDocument_BT24PDF.exepid process 3340 Document_BT24PDF.exe 3340 Document_BT24PDF.exe 3988 Document_BT24PDF.exe 3988 Document_BT24PDF.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Document_BT24PDF.exeDocument_BT24PDF.exedescription pid process Token: SeDebugPrivilege 3340 Document_BT24PDF.exe Token: SeDebugPrivilege 3988 Document_BT24PDF.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Document_BT24PDF.exedescription pid process target process PID 3340 wrote to memory of 3988 3340 Document_BT24PDF.exe Document_BT24PDF.exe PID 3340 wrote to memory of 3988 3340 Document_BT24PDF.exe Document_BT24PDF.exe PID 3340 wrote to memory of 3988 3340 Document_BT24PDF.exe Document_BT24PDF.exe PID 3340 wrote to memory of 3988 3340 Document_BT24PDF.exe Document_BT24PDF.exe PID 3340 wrote to memory of 3988 3340 Document_BT24PDF.exe Document_BT24PDF.exe PID 3340 wrote to memory of 3988 3340 Document_BT24PDF.exe Document_BT24PDF.exe PID 3340 wrote to memory of 3988 3340 Document_BT24PDF.exe Document_BT24PDF.exe PID 3340 wrote to memory of 3988 3340 Document_BT24PDF.exe Document_BT24PDF.exe -
outlook_office_path 1 IoCs
Processes:
Document_BT24PDF.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Document_BT24PDF.exe -
outlook_win_path 1 IoCs
Processes:
Document_BT24PDF.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Document_BT24PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document_BT24PDF.exe"C:\Users\Admin\AppData\Local\Temp\Document_BT24PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\Document_BT24PDF.exe"C:\Users\Admin\AppData\Local\Temp\Document_BT24PDF.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5285b29c5996aba555085ba399ff77e20
SHA18883f82fda1392fdb4e69a5bd5eee8ffdfc21af1
SHA256496fe895cbf117cdad4087accd11c60e3dcd682c579d954e8d69429fb2b613e1
SHA512740f183b3ba5347e2b4860260f3d34cab6e2d509dfa5b2ba190a6c46650d57cdc8ab4c5535f4b29f09fc9c607bdea4b0ba49b6d3e6332b094b24c7ba2e18357a