Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
20/05/2024, 12:08
General
- Target SCAN.AWB.exe
- Size 570KB
- Sample240520-pay1zaad52
- SHA256 7ea4b0492d4bd06af8088ed24374001cabe43bac4a8477c9d4c16428ebe7d511
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.scootero.cl
-
Port
587
-
Username
-
Password
Dangote1235$
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.scootero.cl
-
Port
587
-
Username
-
Password
Dangote1235$
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Loads dropped DLL 2 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SCAN.AWB.exe"C:\Users\Admin\AppData\Local\Temp\SCAN.AWB.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SCAN.AWB.exe"C:\Users\Admin\AppData\Local\Temp\SCAN.AWB.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
nsj512E.tmp
nsj512E.tmp
nsj512E.tmp
nsj512E.tmp
nsj512E.tmp
nsj512E.tmp
System.dll
nsk548D.tmp
nsk548D.tmp
nsk548D.tmp
nsk548D.tmp
nsp5373.tmp
nsp5373.tmp
nsp5373.tmp
nsp5373.tmp
nsp5373.tmp
nsp5373.tmp
nsp5373.tmp
nsz5278.tmp
nsz5278.tmp
nsz5278.tmp
kaleb.ini
memory/3080-848-0x00000000770F1000-0x0000000077211000-memory.dmp
memory/3080-850-0x0000000000490000-0x00000000004D2000-memory.dmp
memory/3080-859-0x00000000363C0000-0x00000000363CA000-memory.dmp
memory/3080-842-0x00000000016F0000-0x0000000002925000-memory.dmp
memory/3080-858-0x00000000362E0000-0x0000000036372000-memory.dmp
memory/3080-844-0x0000000077178000-0x0000000077179000-memory.dmp
memory/3080-845-0x0000000077195000-0x0000000077196000-memory.dmp
memory/3080-856-0x00000000016F0000-0x0000000002925000-memory.dmp
memory/3080-854-0x00000000361C0000-0x000000003625C000-memory.dmp
memory/3080-846-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/3080-853-0x0000000036160000-0x00000000361B0000-memory.dmp
memory/3080-851-0x0000000035240000-0x00000000357E4000-memory.dmp
memory/3080-852-0x00000000357F0000-0x0000000035856000-memory.dmp
memory/4548-849-0x00000000041E0000-0x0000000005415000-memory.dmp
memory/4548-840-0x00000000770F1000-0x0000000077211000-memory.dmp
memory/4548-839-0x00000000041E0000-0x0000000005415000-memory.dmp
memory/4548-843-0x00000000041E0000-0x0000000005415000-memory.dmp
memory/4548-841-0x0000000010004000-0x0000000010005000-memory.dmp