Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22-05-2024 16:57
General
-
Target
3990971d705514cd25bbc3c94b262bc7775928baf3472270b2fa43107ea3d01e.exe
-
Size
862KB
-
MD5
2135fe28ce29c26ac1f9eb94a9dfbc7d
-
SHA1
2c173d28c94b66acc82e92b7ee42c851ea9f829b
-
SHA256
3990971d705514cd25bbc3c94b262bc7775928baf3472270b2fa43107ea3d01e
-
SHA512
98d2fea79aced58e7ce55113b91039d3a54bb0d536f871ad9c635ef6c269cccc81ff580e3b089862c597150acca3dc145df48da1d532fff19c9d005fccf8ba30
-
SSDEEP
12288:KH6GCIxDThB7X4yMm8vw7Du9zPuMMJcjujhVPC2Tt/NiOVWaSuCyIFqvlo:UCIx9BbcPvealP48Qrz5WKcIlo
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.jeepcommerce.rs - Port:
21 - Username:
[email protected] - Password:
UL^Y]#$dMj?2
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3990971d705514cd25bbc3c94b262bc7775928baf3472270b2fa43107ea3d01e.exe"C:\Users\Admin\AppData\Local\Temp\3990971d705514cd25bbc3c94b262bc7775928baf3472270b2fa43107ea3d01e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dzzbbxWYQweGV.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dzzbbxWYQweGV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFDC0.tmp"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpFDC0.tmpFilesize
1KB
MD581d80a567d2759089845cbebfe9ae432
SHA1d89f2302ee365d41a43b87bef6467d7ecd2accee
SHA25696081480778ff6b7844b914dfc7d34441c783ea9751c81c2be8467c9dd9a10d6
SHA5127f9d45b4c0d3299bb4a8a8867bdf469eebb322804bb905632a9bbde908c2a9fe06ff985f3a00a351199f949b4e2d720b04563a95662e27b12f5a2140ee448d5f
-
memory/2140-0-0x0000000073F6E000-0x0000000073F6F000-memory.dmpFilesize
4KB
-
memory/2140-1-0x0000000000360000-0x000000000043E000-memory.dmpFilesize
888KB
-
memory/2140-2-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB
-
memory/2140-3-0x0000000004D40000-0x0000000004DE6000-memory.dmpFilesize
664KB
-
memory/2140-4-0x00000000004E0000-0x00000000004FE000-memory.dmpFilesize
120KB
-
memory/2140-5-0x00000000005A0000-0x00000000005B0000-memory.dmpFilesize
64KB
-
memory/2140-6-0x00000000053C0000-0x0000000005444000-memory.dmpFilesize
528KB
-
memory/2140-12-0x0000000004DF0000-0x0000000004E32000-memory.dmpFilesize
264KB
-
memory/2140-15-0x0000000073F6E000-0x0000000073F6F000-memory.dmpFilesize
4KB
-
memory/2140-16-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB