Analysis
-
max time kernel
67s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2024 01:26
Behavioral task
behavioral1
Sample
0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd.exe
Resource
win10v2004-20240419-en
General
-
Target
0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd.exe
-
Size
245KB
-
MD5
1ec597a87537758c970f797e4d1a3bc6
-
SHA1
eb861337937ab27ebb4f94945047c83f9886cfdb
-
SHA256
0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd
-
SHA512
260cde0b3f2feaf7c07d345d34c32550f6af4496de734eb2f5a2fe0f398ec88f8a66de8f62b8e0d645535cfe4e1d84b94bc071f6875b66cdec22d8912a15f2b5
-
SSDEEP
3072:1YBoUQk4tnyW0NYmA0pJT+9SZfG5utzLOC8N51QHGqVL:1GoUQk4tnyW81A0pJkSZ+ozKC82Hv
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.ykqatar.com - Port:
587 - Username:
[email protected] - Password:
kh831975@ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HIqPv = "C:\\Users\\Admin\\AppData\\Roaming\\HIqPv\\HIqPv.exe" 0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.ipify.org -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd.exepid process 3152 0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd.exe 3152 0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd.exedescription pid process Token: SeDebugPrivilege 3152 0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd.exepid process 3152 0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd.exe"C:\Users\Admin\AppData\Local\Temp\0a153822ed3abd791c3363d474fcb5aed7ce141018bb18de8629be612f6bb7cd.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3152-0-0x0000000000C00000-0x0000000000C44000-memory.dmpFilesize
272KB
-
memory/3152-1-0x0000000074AD0000-0x0000000075280000-memory.dmpFilesize
7.7MB
-
memory/3152-2-0x0000000005BD0000-0x0000000006174000-memory.dmpFilesize
5.6MB
-
memory/3152-3-0x0000000005790000-0x00000000057F6000-memory.dmpFilesize
408KB
-
memory/3152-4-0x00000000055E0000-0x00000000055F0000-memory.dmpFilesize
64KB
-
memory/3152-7-0x0000000006F90000-0x0000000006FE0000-memory.dmpFilesize
320KB
-
memory/3152-8-0x0000000007080000-0x000000000711C000-memory.dmpFilesize
624KB
-
memory/3152-9-0x0000000074AD0000-0x0000000075280000-memory.dmpFilesize
7.7MB
-
memory/3152-10-0x00000000055E0000-0x00000000055F0000-memory.dmpFilesize
64KB
-
memory/3152-11-0x00000000071C0000-0x0000000007252000-memory.dmpFilesize
584KB
-
memory/3152-12-0x0000000007130000-0x000000000713A000-memory.dmpFilesize
40KB