Analysis

  • max time kernel
    143s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 01:23

General

  • Target

    39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe

  • Size

    145KB

  • MD5

    115b5aae8c9a24258d28bfb74f638ac8

  • SHA1

    3265a76ab3e92e5d77336427f3d6892fcb0d9cf7

  • SHA256

    39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a

  • SHA512

    2a8237a4b0f8dfcd6bce208a8b9a096f32edfe8de71ceb35e8bd842ffcc22dceae723c5270e766ab9f10f27e288344dd70d7f66b841cb828d21dcb313d8d058a

  • SSDEEP

    1536:PezR1zewFnNK7GRvKVnnatIl6X0QnX3OON8UbBGk0:PI1zDFMQvynnatC6dW2h0

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1263338506:AAEo1afaqZcanZqwKGJF2HA7xr6YOHyXHtU/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect ZGRat V1 36 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 48 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe
    "C:\Users\Admin\AppData\Local\Temp\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3312
    • C:\Users\Admin\AppData\Local\Temp\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe
      "C:\Users\Admin\AppData\Local\Temp\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3992
      • C:\Users\Admin\AppData\Local\Temp\Thglbuzavc.exe
        "C:\Users\Admin\AppData\Local\Temp\Thglbuzavc.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5696
        • C:\Users\Admin\AppData\Local\Temp\Thglbuzavc.exe
          "C:\Users\Admin\AppData\Local\Temp\Thglbuzavc.exe"
          4⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • outlook_office_path
          • outlook_win_path
          PID:5940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\39f92d713caf05bf9043db2649aea9d2df4bd03e139c09a8e68dfca21d545f4a.exe.log

    Filesize

    1KB

    MD5

    f3eb81974dc5933681e933f07209ff5f

    SHA1

    7af8cae0f1d03e82daaf784df9886705685baac7

    SHA256

    e82069884dd428bd6a1c67fe00c5fa56f9c4d62b538b694694a699588f1f4ab2

    SHA512

    d9aa3871dffb76c8a73a7940fa03bbc9b65cf575cbd07f7c1fbf490cb0f3d670415eaef0bf79e34689f61ab3cdfbb104efdef004becc12e54b501f02f948aaff

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Thglbuzavc.exe.log

    Filesize

    805B

    MD5

    58a9108e39c2ea50e65c23be3a9407cf

    SHA1

    fb21f7b9330aa1a77080a3243b81b49035102d7b

    SHA256

    6049be83020702896a539b5c8c13270add224d7b91b3ee0bebc328791b74a84b

    SHA512

    93804ee8a4560503e47c07f5fa4a959e23355a01aba406c103d339debc9b2b1d20a345cdbb8d8069dac97b9151f228cf559ac3dde1500e3484fba1a4126842bf

  • C:\Users\Admin\AppData\Local\Temp\Mzsakp.tmpdb

    Filesize

    124KB

    MD5

    9618e15b04a4ddb39ed6c496575f6f95

    SHA1

    1c28f8750e5555776b3c80b187c5d15a443a7412

    SHA256

    a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

    SHA512

    f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

  • C:\Users\Admin\AppData\Local\Temp\Nrtrg.tmpdb

    Filesize

    152KB

    MD5

    73bd1e15afb04648c24593e8ba13e983

    SHA1

    4dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91

    SHA256

    aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b

    SHA512

    6eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7

  • C:\Users\Admin\AppData\Local\Temp\Thglbuzavc.exe

    Filesize

    2.3MB

    MD5

    b5b77f0c912f438cbc5142c42818fa29

    SHA1

    94b5df605f00d34581435e3ca10b47094e31c0ab

    SHA256

    ab3f0c321894430eed1ba65eca338a0471e18ba82cdd554084ed63f36ff91dce

    SHA512

    87a1fbb1b8187377997b219bf6b286102648ff913ab0d73c78c67bee443702e9824bc14e980a2d38e5ece9a1fccc6e134f5dfa6f2b9bd9604ccb0d140418424f

  • \??\c:\users\admin\appdata\roaming\notepad.exe

    Filesize

    2.3MB

    MD5

    3e1044c6fe5320b1f34518af791a280f

    SHA1

    08a120be0bad2432304ef307d19199ff5f154404

    SHA256

    c417dbc779736c6179af9f115300dbb871b3010b459360dc0a93ef56301dc051

    SHA512

    89b2a47b3ed5470702cf6061675940eed191c5ff4ff953814a3d3278b619bd2669cfcd56ba3bc9d9ae2fb8287b24bbb98da58251a396c7456ccfa418a25cf204

  • memory/3312-26-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-36-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-10-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-18-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-16-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-24-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-22-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-54-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-56-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-66-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-64-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-70-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-68-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-7-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-60-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-58-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-52-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-50-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-48-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-46-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-44-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-42-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-40-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-38-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-4887-0x0000000074CE0000-0x0000000075490000-memory.dmp

    Filesize

    7.7MB

  • memory/3312-30-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-20-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-34-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-32-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-28-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-0-0x0000000074CEE000-0x0000000074CEF000-memory.dmp

    Filesize

    4KB

  • memory/3312-8-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-1-0x00000000004F0000-0x0000000000516000-memory.dmp

    Filesize

    152KB

  • memory/3312-62-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-12-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-4888-0x0000000005870000-0x0000000005998000-memory.dmp

    Filesize

    1.2MB

  • memory/3312-4889-0x0000000005780000-0x00000000057CC000-memory.dmp

    Filesize

    304KB

  • memory/3312-4890-0x0000000006010000-0x0000000006064000-memory.dmp

    Filesize

    336KB

  • memory/3312-3-0x0000000074CE0000-0x0000000075490000-memory.dmp

    Filesize

    7.7MB

  • memory/3312-4897-0x0000000074CE0000-0x0000000075490000-memory.dmp

    Filesize

    7.7MB

  • memory/3312-14-0x00000000074E0000-0x00000000077C6000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-2-0x0000000001060000-0x0000000001066000-memory.dmp

    Filesize

    24KB

  • memory/3312-6-0x0000000007870000-0x0000000007902000-memory.dmp

    Filesize

    584KB

  • memory/3312-4-0x00000000074E0000-0x00000000077CC000-memory.dmp

    Filesize

    2.9MB

  • memory/3312-5-0x0000000007D80000-0x0000000008324000-memory.dmp

    Filesize

    5.6MB

  • memory/3992-7191-0x0000000004DD0000-0x0000000004E40000-memory.dmp

    Filesize

    448KB

  • memory/3992-7192-0x0000000004E40000-0x0000000004E4A000-memory.dmp

    Filesize

    40KB

  • memory/3992-7193-0x0000000005530000-0x0000000005596000-memory.dmp

    Filesize

    408KB

  • memory/3992-7194-0x0000000006620000-0x000000000669A000-memory.dmp

    Filesize

    488KB

  • memory/3992-7190-0x0000000004B90000-0x0000000004C2E000-memory.dmp

    Filesize

    632KB

  • memory/3992-4896-0x0000000004910000-0x0000000004A26000-memory.dmp

    Filesize

    1.1MB

  • memory/3992-7247-0x0000000074CE0000-0x0000000075490000-memory.dmp

    Filesize

    7.7MB

  • memory/3992-7248-0x0000000074CE0000-0x0000000075490000-memory.dmp

    Filesize

    7.7MB

  • memory/3992-5169-0x0000000074CE0000-0x0000000075490000-memory.dmp

    Filesize

    7.7MB

  • memory/3992-7254-0x0000000074CE0000-0x0000000075490000-memory.dmp

    Filesize

    7.7MB

  • memory/3992-4923-0x0000000074CE0000-0x0000000075490000-memory.dmp

    Filesize

    7.7MB

  • memory/3992-4895-0x0000000000500000-0x00000000005D8000-memory.dmp

    Filesize

    864KB

  • memory/5696-12138-0x0000000074CE0000-0x0000000075490000-memory.dmp

    Filesize

    7.7MB

  • memory/5696-7255-0x0000000074CE0000-0x0000000075490000-memory.dmp

    Filesize

    7.7MB

  • memory/5696-12139-0x0000000005AC0000-0x0000000005B2C000-memory.dmp

    Filesize

    432KB

  • memory/5696-7256-0x0000000005600000-0x0000000005830000-memory.dmp

    Filesize

    2.2MB

  • memory/5696-12137-0x0000000074CE0000-0x0000000075490000-memory.dmp

    Filesize

    7.7MB

  • memory/5696-12146-0x0000000074CE0000-0x0000000075490000-memory.dmp

    Filesize

    7.7MB

  • memory/5696-7253-0x00000000009E0000-0x0000000000C32000-memory.dmp

    Filesize

    2.3MB

  • memory/5940-12148-0x0000000006710000-0x0000000006760000-memory.dmp

    Filesize

    320KB

  • memory/5940-12147-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/5940-12149-0x0000000006800000-0x000000000689C000-memory.dmp

    Filesize

    624KB

  • memory/5940-12150-0x00000000068D0000-0x00000000068DA000-memory.dmp

    Filesize

    40KB