Overview

overview

10

Static

static

3

DA HONG 16...DF.scr

windows7-x64

10

DA HONG 16...DF.scr

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 23:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    DA HONG 16 SHIP DETAILS.1.PDF.scr

  • Size

    656KB

  • MD5

    c63cebeaae6c25d95a7d3066b93ae1be

  • SHA1

    ac338a3b364333178df8acda49873ad9716a3e9b

  • SHA256

    227b52e8c9ed77b2fe6cec5e09c8898924d157034b5f7ba2bffcb2a3c3cbe949

  • SHA512

    43ee5cd986b92f5124abdf511561af6b0a054b762d268adb976aee8473abfbf23599816ed366b77af5477f78d4de4333e142e1f82cd27dace18071cbd270eb62

  • SSDEEP

    12288:XlYifTcClSW15Xkep2WThbNG0CAu6bCxSexegZo1iCTA6koWn95OyLvqj:2iVll5XTliAu6ORogYiqA6e95OyLCj

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    beirutrest.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    9yXQ39wz(uL+

Extracted

Family

agenttesla

Credentials

  • Protocol:     ftp
  • Host:
    ftp://beirutrest.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    9yXQ39wz(uL+

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DA HONG 16 SHIP DETAILS.1.PDF.scr
    "C:\Users\Admin\AppData\Local\Temp\DA HONG 16 SHIP DETAILS.1.PDF.scr" /S
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4840
    • C:\Users\Admin\AppData\Local\Temp\DA HONG 16 SHIP DETAILS.1.PDF.scr
      "C:\Users\Admin\AppData\Local\Temp\DA HONG 16 SHIP DETAILS.1.PDF.scr"
      2⤵
        PID:968
      • C:\Users\Admin\AppData\Local\Temp\DA HONG 16 SHIP DETAILS.1.PDF.scr
        "C:\Users\Admin\AppData\Local\Temp\DA HONG 16 SHIP DETAILS.1.PDF.scr"
        2⤵
          PID:3692
        • C:\Users\Admin\AppData\Local\Temp\DA HONG 16 SHIP DETAILS.1.PDF.scr
          "C:\Users\Admin\AppData\Local\Temp\DA HONG 16 SHIP DETAILS.1.PDF.scr"
          2⤵
            PID:4120
          • C:\Users\Admin\AppData\Local\Temp\DA HONG 16 SHIP DETAILS.1.PDF.scr
            "C:\Users\Admin\AppData\Local\Temp\DA HONG 16 SHIP DETAILS.1.PDF.scr"
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4876
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5064 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:2212

          Network

          MITRE ATT&CK Matrix ATT&CK v13

          Initial Access

          Execution

          Persistence

          Privilege Escalation

          Defense Evasion

          Credential Access

          Unsecured Credentials

          4
          T1552

          Credentials In Files

          3
          T1552.001

          Credentials in Registry

          1
          T1552.002

          Discovery

          Lateral Movement

          Collection

          Data from Local System

          4
          T1005

          Exfiltration

          Command and Control

          Impact

          Resource Development

          Reconnaissance

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4840-8-0x0000000074FEE000-0x0000000074FEF000-memory.dmp
            Filesize

            4KB

            Download
          • memory/4840-14-0x0000000074FE0000-0x0000000075790000-memory.dmp
            Filesize

            7.7MB

            Download
          • memory/4840-0-0x0000000074FEE000-0x0000000074FEF000-memory.dmp
            Filesize

            4KB

            Download
          • memory/4840-3-0x0000000004F10000-0x0000000004FA2000-memory.dmp
            Filesize

            584KB

            Download
          • memory/4840-4-0x0000000074FE0000-0x0000000075790000-memory.dmp
            Filesize

            7.7MB

            Download
          • memory/4840-5-0x0000000004FD0000-0x0000000004FDA000-memory.dmp
            Filesize

            40KB

            Download
          • memory/4840-6-0x0000000005220000-0x00000000052BC000-memory.dmp
            Filesize

            624KB

            Download
          • memory/4840-7-0x00000000050F0000-0x000000000510A000-memory.dmp
            Filesize

            104KB

            Download
          • memory/4840-2-0x00000000055C0000-0x0000000005B64000-memory.dmp
            Filesize

            5.6MB

            Download
          • memory/4840-9-0x0000000005110000-0x0000000005120000-memory.dmp
            Filesize

            64KB

            Download
          • memory/4840-17-0x0000000074FE0000-0x0000000075790000-memory.dmp
            Filesize

            7.7MB

            Download
          • memory/4840-10-0x0000000006C50000-0x0000000006CD2000-memory.dmp
            Filesize

            520KB

            Download
          • memory/4840-1-0x00000000004A0000-0x000000000054A000-memory.dmp
            Filesize

            680KB

            Download
          • memory/4876-13-0x0000000074FE0000-0x0000000075790000-memory.dmp
            Filesize

            7.7MB

            Download
          • memory/4876-11-0x0000000000400000-0x0000000000440000-memory.dmp
            Filesize

            256KB

            Download
          • memory/4876-16-0x0000000074FE0000-0x0000000075790000-memory.dmp
            Filesize

            7.7MB

            Download
          • memory/4876-15-0x0000000004F50000-0x0000000004FB6000-memory.dmp
            Filesize

            408KB

            Download
          • memory/4876-18-0x00000000066E0000-0x0000000006730000-memory.dmp
            Filesize

            320KB

            Download
          • memory/4876-19-0x0000000074FE0000-0x0000000075790000-memory.dmp
            Filesize

            7.7MB

            Download