Analysis

  • max time kernel
    66s
  • max time network
    53s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 01:06

General

  • Target

    b8ba367e0e847db97a2df73f6edb2b0c6656bf9d275f6ba6c0e3e8f1be1975de.exe

  • Size

    689KB

  • MD5

    1ada035e5d065c9f72c0edaede3d23fb

  • SHA1

    a078f140862da6ea430f4eb6090a674f1625c437

  • SHA256

    b8ba367e0e847db97a2df73f6edb2b0c6656bf9d275f6ba6c0e3e8f1be1975de

  • SHA512

    3fc582cb2d4989c62d3341afcdc197b179b65e845fd33c1321a88338d1c443c9f210f97e623062cb9ebe8eae7a65e4555f965407af545b15d2c625766b41e48d

  • SSDEEP

    12288:3YV6MorX7qzuC3QHO9FQVHPF51jgcdBQ+3TTuJ3sOi:EBXu9HGaVHd9i3s/

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://inhanoi.net.vn
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    ^TSt3!FK$UBA

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8ba367e0e847db97a2df73f6edb2b0c6656bf9d275f6ba6c0e3e8f1be1975de.exe
    "C:\Users\Admin\AppData\Local\Temp\b8ba367e0e847db97a2df73f6edb2b0c6656bf9d275f6ba6c0e3e8f1be1975de.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3144
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\b8ba367e0e847db97a2df73f6edb2b0c6656bf9d275f6ba6c0e3e8f1be1975de.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3144-14-0x00000000007F0000-0x0000000000975000-memory.dmp
    Filesize

    1.5MB

  • memory/3144-11-0x0000000001330000-0x0000000001334000-memory.dmp
    Filesize

    16KB

  • memory/3144-0-0x00000000007F0000-0x0000000000975000-memory.dmp
    Filesize

    1.5MB

  • memory/3808-17-0x0000000005930000-0x0000000005940000-memory.dmp
    Filesize

    64KB

  • memory/3808-15-0x0000000075170000-0x0000000075920000-memory.dmp
    Filesize

    7.7MB

  • memory/3808-16-0x0000000005EF0000-0x0000000006494000-memory.dmp
    Filesize

    5.6MB

  • memory/3808-12-0x0000000000400000-0x0000000000440000-memory.dmp
    Filesize

    256KB

  • memory/3808-18-0x0000000005A40000-0x0000000005AA6000-memory.dmp
    Filesize

    408KB

  • memory/3808-19-0x0000000006EA0000-0x0000000006EF0000-memory.dmp
    Filesize

    320KB

  • memory/3808-20-0x0000000006F90000-0x0000000007022000-memory.dmp
    Filesize

    584KB

  • memory/3808-21-0x0000000006F10000-0x0000000006F1A000-memory.dmp
    Filesize

    40KB

  • memory/3808-22-0x0000000075170000-0x0000000075920000-memory.dmp
    Filesize

    7.7MB

  • memory/3808-23-0x0000000005930000-0x0000000005940000-memory.dmp
    Filesize

    64KB