Analysis

  • max time kernel
    66s
  • max time network
    57s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-04-2024 01:15

General

  • Target

    ba224a4ba38306a675c6b2567488634017dbcab8aee6ee0bd727d0e329e9e239.exe

  • Size

    689KB

  • MD5

    917c4f19408ea09ee9366002f2e77bf6

  • SHA1

    09b9d1545889e38d7d9f8f63ca5ab3ad8651a304

  • SHA256

    ba224a4ba38306a675c6b2567488634017dbcab8aee6ee0bd727d0e329e9e239

  • SHA512

    4a66744bcdf485d724ba4eadf496379935ff8bf006ec8bbda4f034c45ef4a014bfec26efea2ab2da266147dd00521ee1e392e2c46635899f6b1c8cdf85269f5e

  • SSDEEP

    12288:vYIPXjjOlMcW5hxtti8sQvX5L2pk56MU6ongQUph7HX6H+zl:vYIPfOlMNdievYk5HogQUpNCkl

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://eu-west-1.sftpcloud.io
  • Port:
    21
  • Username:
    8e065e20d50941049d65f96f62357139
  • Password:
    26esZMYm4svydFPPVNZDGTMnq25MRawd

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ba224a4ba38306a675c6b2567488634017dbcab8aee6ee0bd727d0e329e9e239.exe
    "C:\Users\Admin\AppData\Local\Temp\ba224a4ba38306a675c6b2567488634017dbcab8aee6ee0bd727d0e329e9e239.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4084
    • C:\Users\Admin\AppData\Local\Temp\ba224a4ba38306a675c6b2567488634017dbcab8aee6ee0bd727d0e329e9e239.exe
      "C:\Users\Admin\AppData\Local\Temp\ba224a4ba38306a675c6b2567488634017dbcab8aee6ee0bd727d0e329e9e239.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1700
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 1232
      2⤵
      • Program crash
      PID:3664
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4084 -ip 4084
    1⤵
      PID:3660

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Credential Access

    Unsecured Credentials

    4
    T1552

    Credentials In Files

    3
    T1552.001

    Credentials in Registry

    1
    T1552.002

    Collection

    Data from Local System

    4
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1700-10-0x0000000000400000-0x0000000000440000-memory.dmp
      Filesize

      256KB

    • memory/1700-19-0x0000000074F20000-0x00000000756D0000-memory.dmp
      Filesize

      7.7MB

    • memory/1700-18-0x00000000062A0000-0x00000000062F0000-memory.dmp
      Filesize

      320KB

    • memory/1700-16-0x0000000005460000-0x00000000054C6000-memory.dmp
      Filesize

      408KB

    • memory/1700-14-0x0000000074F20000-0x00000000756D0000-memory.dmp
      Filesize

      7.7MB

    • memory/4084-8-0x00000000067C0000-0x0000000006842000-memory.dmp
      Filesize

      520KB

    • memory/4084-13-0x0000000074F20000-0x00000000756D0000-memory.dmp
      Filesize

      7.7MB

    • memory/4084-7-0x0000000006200000-0x0000000006214000-memory.dmp
      Filesize

      80KB

    • memory/4084-0-0x0000000000560000-0x0000000000612000-memory.dmp
      Filesize

      712KB

    • memory/4084-9-0x000000000D110000-0x000000000D1AC000-memory.dmp
      Filesize

      624KB

    • memory/4084-5-0x0000000004EC0000-0x0000000004ECA000-memory.dmp
      Filesize

      40KB

    • memory/4084-12-0x000000000D4B0000-0x000000000D804000-memory.dmp
      Filesize

      3.3MB

    • memory/4084-6-0x00000000054B0000-0x00000000054D0000-memory.dmp
      Filesize

      128KB

    • memory/4084-15-0x0000000004F00000-0x0000000004F10000-memory.dmp
      Filesize

      64KB

    • memory/4084-4-0x0000000004F00000-0x0000000004F10000-memory.dmp
      Filesize

      64KB

    • memory/4084-3-0x0000000004F30000-0x0000000004FC2000-memory.dmp
      Filesize

      584KB

    • memory/4084-17-0x0000000074F20000-0x00000000756D0000-memory.dmp
      Filesize

      7.7MB

    • memory/4084-2-0x00000000054E0000-0x0000000005A84000-memory.dmp
      Filesize

      5.6MB

    • memory/4084-1-0x0000000074F20000-0x00000000756D0000-memory.dmp
      Filesize

      7.7MB