Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
29-04-2024 04:17
General
-
Target
SecuriteInfo.com.Win32.RATX-gen.18729.16741.exe
-
Size
670KB
-
MD5
c03df73f42c3cf0633c62b518049e6d7
-
SHA1
91ae9b1f2d9a63f8873ef417a81c1b3ee9bf7742
-
SHA256
a0256620e6fca3aed48fb36d3d7d798e5d0f790bdfaf93e56a4b9471ade8f7e7
-
SHA512
5ff6242cd45430797008be8e974fe9da230750437d0d6e6367564675e65ed2a075f510599a5789faa3e96723a33f27a79d6cd134d86e4534423c26998ea339d1
-
SSDEEP
12288:40BB778QNGSyjVmrRmm1xy56gdQSrH78yCe38urnFkisI+hNZ9dD88p6Z/A2CnkR:HBBnG/Ymm1xy56rSrHIy8+jh+XPdDpe3
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.metalsbox.com - Port:
587 - Username:
[email protected] - Password:
zxcA@@258963 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.18729.16741.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.18729.16741.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.18729.16741.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.18729.16741.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2544-21-0x0000000004460000-0x00000000044A0000-memory.dmpFilesize
256KB
-
memory/2544-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2544-7-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2544-23-0x0000000074960000-0x000000007504E000-memory.dmpFilesize
6.9MB
-
memory/2544-15-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2544-20-0x0000000074960000-0x000000007504E000-memory.dmpFilesize
6.9MB
-
memory/2544-9-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2544-19-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2544-24-0x0000000004460000-0x00000000044A0000-memory.dmpFilesize
256KB
-
memory/2544-11-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2544-8-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2544-17-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2804-5-0x0000000000450000-0x0000000000466000-memory.dmpFilesize
88KB
-
memory/2804-22-0x0000000074960000-0x000000007504E000-memory.dmpFilesize
6.9MB
-
memory/2804-6-0x0000000004E50000-0x0000000004ED4000-memory.dmpFilesize
528KB
-
memory/2804-0-0x0000000000D00000-0x0000000000DAA000-memory.dmpFilesize
680KB
-
memory/2804-1-0x0000000074960000-0x000000007504E000-memory.dmpFilesize
6.9MB
-
memory/2804-4-0x0000000000440000-0x000000000044E000-memory.dmpFilesize
56KB
-
memory/2804-3-0x00000000003E0000-0x00000000003F8000-memory.dmpFilesize
96KB
-
memory/2804-2-0x0000000004BC0000-0x0000000004C00000-memory.dmpFilesize
256KB