General

  • Target

    SOA FOR APR 2024 PDF.rar

  • Size

    660KB

  • Sample

    240426-ht1wcabd27

  • MD5

    56eb77f8baeed032115463e8e0ce7a47

  • SHA1

    f16c6ecefbc67cd4c9cbf54f5bf91802ffd98c17

  • SHA256

    470582badbb9549c5a60a0afc30745d6978f3586f72a4ed1b9cac0ab1e379fe0

  • SHA512

    b3438f0f449c5bbbc692b197838c35eac5156906608a2eea26272493c1345326dde5584d4d72e489a4c22bf07bb81c0e38e3dca2e35689636f694b609f3a7b12

  • SSDEEP

    12288:nHiPlosLS4BWquZotYG1WnmB+mf6JFCrwh4fMxu6ufi4gX:nHiNn1BduZoOG4mB+Mi9oMx3ufiN

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.fascia-arch.com
  • Port:
    587
  • Username:
    brian@fascia-arch.com
  • Password:
    HERbertstown1987
  • Email To:
    donj5425@gmail.com

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.fascia-arch.com
  • Port:
    587
  • Username:
    brian@fascia-arch.com
  • Password:
    HERbertstown1987

Targets

    • Target

      SOA FOR APR 2024 PDF.exe

    • Size

      706KB

    • MD5

      7a6e9d01d9162c7537ba8091187e4235

    • SHA1

      f5b69f4b0ec8cd0a4b7bab26a0de167c8cc535cd

    • SHA256

      7fd14673f73717b024728ae4248be0a1579f480a261c4f4d94742f230a01cb47

    • SHA512

      7af388861a5be63b87e8159e2b20bf78d110517b8db6a314a7128cba29075734be43c543b1d701e360778d539951c58e3c06bc2ee2e2ad6855d0067fff55a199

    • SSDEEP

      12288:mWYIPXjxannnHg2rA1a8vHKzUREMEngfnRhU0KjqdAwz725zfjVfjKIsj+1F0DxY:mWYIPFannnHg2Qa86n0LdAA70ztjRh0W

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

4
T1005

Tasks