Analysis

  • max time kernel
    117s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 01:14

General

  • Target

    82ea203ea87c9cdb6090eb33435067a3db373adcd0f485cde84d88b363d6e82b.exe

  • Size

    245KB

  • MD5

    29b63d1cef2be44750c9a3fa60432d77

  • SHA1

    dcd58c72c76a9a3f92d61316f3d70c939e854d9d

  • SHA256

    82ea203ea87c9cdb6090eb33435067a3db373adcd0f485cde84d88b363d6e82b

  • SHA512

    18e34749e8709931c7fae42dcf6ba3adb9ccf4428d79cf32c95e72f38563b035299f26047679f4017a54331d807b1ddddade7e115d66e46bed6b4bad2da80a99

  • SSDEEP

    3072:zPkeqfrvzvx5Bsig4qvZSTu7OBtUgnlVW5QVDoJxH:zMeqfrvzvx5BRg4blz5n31DK

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.2mfs.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ibile.ibile@123

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82ea203ea87c9cdb6090eb33435067a3db373adcd0f485cde84d88b363d6e82b.exe
    "C:\Users\Admin\AppData\Local\Temp\82ea203ea87c9cdb6090eb33435067a3db373adcd0f485cde84d88b363d6e82b.exe"
    1⤵
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2888

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Collection

Data from Local System

4
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2888-0-0x0000000000B20000-0x0000000000B64000-memory.dmp
    Filesize

    272KB

  • memory/2888-1-0x0000000074B20000-0x000000007520E000-memory.dmp
    Filesize

    6.9MB

  • memory/2888-2-0x0000000004A40000-0x0000000004A80000-memory.dmp
    Filesize

    256KB

  • memory/2888-19-0x0000000074B20000-0x000000007520E000-memory.dmp
    Filesize

    6.9MB

  • memory/2888-20-0x0000000004A40000-0x0000000004A80000-memory.dmp
    Filesize

    256KB