Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-04-2024 01:22

General

  • Target

    22a9af12aa1ebf30e2c6975aa4b8e5bc3b5967c55bcfd596233e4f28b3c646e9.exe

  • Size

    746KB

  • MD5

    7a323326eb6723bf356cd8752077a797

  • SHA1

    1e18fe521ff092bfc698dbe31df20c6be4c9acd5

  • SHA256

    22a9af12aa1ebf30e2c6975aa4b8e5bc3b5967c55bcfd596233e4f28b3c646e9

  • SHA512

    3d7e369b198cb9ec3a2f5bf6860d423e0542f71143a05172926a180d2ec6eaf55d575e25d11ac8c335048c69fe7b6bea67b6b406cf15fbd630b726d0685deca1

  • SSDEEP

    12288:k0KoFwaQyhwM1hilZBrOAoovdMHw9T8FmhiCxaqDmm6:jKo9+M1clmAo00w9oNGaqDmb

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    .Password: mt!VMNE0

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\22a9af12aa1ebf30e2c6975aa4b8e5bc3b5967c55bcfd596233e4f28b3c646e9.exe
    "C:\Users\Admin\AppData\Local\Temp\22a9af12aa1ebf30e2c6975aa4b8e5bc3b5967c55bcfd596233e4f28b3c646e9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\Users\Admin\AppData\Local\Temp\22a9af12aa1ebf30e2c6975aa4b8e5bc3b5967c55bcfd596233e4f28b3c646e9.exe
      "C:\Users\Admin\AppData\Local\Temp\22a9af12aa1ebf30e2c6975aa4b8e5bc3b5967c55bcfd596233e4f28b3c646e9.exe"
      2⤵
        PID:3176
      • C:\Users\Admin\AppData\Local\Temp\22a9af12aa1ebf30e2c6975aa4b8e5bc3b5967c55bcfd596233e4f28b3c646e9.exe
        "C:\Users\Admin\AppData\Local\Temp\22a9af12aa1ebf30e2c6975aa4b8e5bc3b5967c55bcfd596233e4f28b3c646e9.exe"
        2⤵
          PID:2488
        • C:\Users\Admin\AppData\Local\Temp\22a9af12aa1ebf30e2c6975aa4b8e5bc3b5967c55bcfd596233e4f28b3c646e9.exe
          "C:\Users\Admin\AppData\Local\Temp\22a9af12aa1ebf30e2c6975aa4b8e5bc3b5967c55bcfd596233e4f28b3c646e9.exe"
          2⤵
            PID:1432
          • C:\Users\Admin\AppData\Local\Temp\22a9af12aa1ebf30e2c6975aa4b8e5bc3b5967c55bcfd596233e4f28b3c646e9.exe
            "C:\Users\Admin\AppData\Local\Temp\22a9af12aa1ebf30e2c6975aa4b8e5bc3b5967c55bcfd596233e4f28b3c646e9.exe"
            2⤵
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3708

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\22a9af12aa1ebf30e2c6975aa4b8e5bc3b5967c55bcfd596233e4f28b3c646e9.exe.log

          Filesize

          1KB

          MD5

          8ec831f3e3a3f77e4a7b9cd32b48384c

          SHA1

          d83f09fd87c5bd86e045873c231c14836e76a05c

          SHA256

          7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

          SHA512

          26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

        • memory/220-4-0x00000000052A0000-0x00000000052B0000-memory.dmp

          Filesize

          64KB

        • memory/220-3-0x00000000052F0000-0x0000000005382000-memory.dmp

          Filesize

          584KB

        • memory/220-10-0x0000000009170000-0x000000000920C000-memory.dmp

          Filesize

          624KB

        • memory/220-9-0x0000000006B10000-0x0000000006B92000-memory.dmp

          Filesize

          520KB

        • memory/220-5-0x00000000052C0000-0x00000000052CA000-memory.dmp

          Filesize

          40KB

        • memory/220-6-0x00000000056D0000-0x00000000056E6000-memory.dmp

          Filesize

          88KB

        • memory/220-7-0x00000000064C0000-0x00000000064C8000-memory.dmp

          Filesize

          32KB

        • memory/220-8-0x00000000065F0000-0x00000000065FC000-memory.dmp

          Filesize

          48KB

        • memory/220-16-0x0000000075120000-0x00000000758D0000-memory.dmp

          Filesize

          7.7MB

        • memory/220-2-0x0000000005800000-0x0000000005DA4000-memory.dmp

          Filesize

          5.6MB

        • memory/220-0-0x00000000007F0000-0x00000000008B0000-memory.dmp

          Filesize

          768KB

        • memory/220-1-0x0000000075120000-0x00000000758D0000-memory.dmp

          Filesize

          7.7MB

        • memory/3708-20-0x0000000075120000-0x00000000758D0000-memory.dmp

          Filesize

          7.7MB

        • memory/3708-14-0x0000000075120000-0x00000000758D0000-memory.dmp

          Filesize

          7.7MB

        • memory/3708-15-0x0000000005AC0000-0x0000000005B26000-memory.dmp

          Filesize

          408KB

        • memory/3708-17-0x0000000005800000-0x0000000005810000-memory.dmp

          Filesize

          64KB

        • memory/3708-19-0x0000000007020000-0x0000000007070000-memory.dmp

          Filesize

          320KB

        • memory/3708-11-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB