Analysis

  • max time kernel
    127s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2024, 10:36

General

  • Target

    5c1009bc821a697905465a8c104b90813332d5815a85b73cea23131b930db557.exe

  • Size

    724KB

  • MD5

    8e55bf75f4c476a962dce1015f5ffcb6

  • SHA1

    c4d98f982e78cd04cd075e4692b7e83a23f4f939

  • SHA256

    5c1009bc821a697905465a8c104b90813332d5815a85b73cea23131b930db557

  • SHA512

    95256ac59e72c12ece1e662c43d4ed52c365e41be68852eaad6832c44ac9fb3f2474bfc832a57b55c185ef4cc2195ded4e174b660fbad577a6b27700fade0100

  • SSDEEP

    12288:SDzWNjpkskxRDqaCgqaR5F6HkkoFK/iZ1PzHnHlbxd3PIdfq2VaVWswQhvi6sul7:SDzWNjpkskxRDqaCgqaR+tM9zHnHlbxU

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c1009bc821a697905465a8c104b90813332d5815a85b73cea23131b930db557.exe
    "C:\Users\Admin\AppData\Local\Temp\5c1009bc821a697905465a8c104b90813332d5815a85b73cea23131b930db557.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Users\Admin\AppData\Local\Temp\5c1009bc821a697905465a8c104b90813332d5815a85b73cea23131b930db557.exe
      "C:\Users\Admin\AppData\Local\Temp\5c1009bc821a697905465a8c104b90813332d5815a85b73cea23131b930db557.exe"
      2⤵
        PID:2536
      • C:\Users\Admin\AppData\Local\Temp\5c1009bc821a697905465a8c104b90813332d5815a85b73cea23131b930db557.exe
        "C:\Users\Admin\AppData\Local\Temp\5c1009bc821a697905465a8c104b90813332d5815a85b73cea23131b930db557.exe"
        2⤵
          PID:440
        • C:\Users\Admin\AppData\Local\Temp\5c1009bc821a697905465a8c104b90813332d5815a85b73cea23131b930db557.exe
          "C:\Users\Admin\AppData\Local\Temp\5c1009bc821a697905465a8c104b90813332d5815a85b73cea23131b930db557.exe"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1248
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4404,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
        1⤵
          PID:1544

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5c1009bc821a697905465a8c104b90813332d5815a85b73cea23131b930db557.exe.log

                Filesize

                1KB

                MD5

                b7b9acb869ccc7f7ecb5304ec0384dee

                SHA1

                6a90751c95817903ee833d59a0abbef425a613b3

                SHA256

                8cb00a15cd942a1861c573d86d6fb430512c8e2f80f6349f48b16b8709ca7aa4

                SHA512

                7bec881ac5f59ac26f1be1e7e26d63f040c06369de10c1c246e531a4395d27c335d9acc647ecdedb48ed37bdc2dc405a4cfc11762e1c00659a49be259eaf8764

              • memory/1248-12-0x0000000000400000-0x0000000000442000-memory.dmp

                Filesize

                264KB

              • memory/1248-20-0x0000000074B70000-0x0000000075320000-memory.dmp

                Filesize

                7.7MB

              • memory/1248-19-0x0000000006F50000-0x0000000006FA0000-memory.dmp

                Filesize

                320KB

              • memory/1248-17-0x0000000005A30000-0x0000000005A96000-memory.dmp

                Filesize

                408KB

              • memory/1248-18-0x0000000074B70000-0x0000000075320000-memory.dmp

                Filesize

                7.7MB

              • memory/1248-16-0x0000000074B70000-0x0000000075320000-memory.dmp

                Filesize

                7.7MB

              • memory/2080-5-0x0000000005270000-0x000000000527A000-memory.dmp

                Filesize

                40KB

              • memory/2080-8-0x0000000006BD0000-0x0000000006BF0000-memory.dmp

                Filesize

                128KB

              • memory/2080-9-0x00000000066B0000-0x00000000066C0000-memory.dmp

                Filesize

                64KB

              • memory/2080-10-0x00000000066C0000-0x00000000066D6000-memory.dmp

                Filesize

                88KB

              • memory/2080-11-0x0000000006C00000-0x0000000006C84000-memory.dmp

                Filesize

                528KB

              • memory/2080-6-0x0000000074B70000-0x0000000075320000-memory.dmp

                Filesize

                7.7MB

              • memory/2080-7-0x00000000053C0000-0x000000000545C000-memory.dmp

                Filesize

                624KB

              • memory/2080-15-0x0000000074B70000-0x0000000075320000-memory.dmp

                Filesize

                7.7MB

              • memory/2080-0-0x0000000074B7E000-0x0000000074B7F000-memory.dmp

                Filesize

                4KB

              • memory/2080-4-0x0000000005B40000-0x0000000005E94000-memory.dmp

                Filesize

                3.3MB

              • memory/2080-3-0x0000000005080000-0x0000000005112000-memory.dmp

                Filesize

                584KB

              • memory/2080-2-0x0000000005590000-0x0000000005B34000-memory.dmp

                Filesize

                5.6MB

              • memory/2080-1-0x0000000000560000-0x000000000061C000-memory.dmp

                Filesize

                752KB