Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 20:45
Static task
static1
Behavioral task
behavioral1
Sample
tmp6x00xzqq.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
tmp6x00xzqq.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240426-en
General
-
Target
tmp6x00xzqq.exe
-
Size
701KB
-
MD5
cd46396fa20831c4ec0acea6534d020f
-
SHA1
1736c61d635cc61d8e9ec6b0dd15ddf814657fc5
-
SHA256
c90f02f4c4f58772131c5fc1b8cc8acc647005189e1abd87ecae379a41b0eac8
-
SHA512
b40e2fe2faab4a4faf3c6e82cd778868fb275e41b55f40a6f566eecab23aac42e0956b261b124c47849bcc8d6a4809192c5ec21e301d8d513b9391571b7cdc91
-
SSDEEP
12288:Cvp1DrAkngRmfxs7ZsGYAG5utPHH9oTHhwOR6bu:enDrA/mfWZsGY7+0ho
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.lumies.co.za - Port:
587 - Username:
[email protected] - Password:
vj$)KFsCyFOr - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
Processes:
tmp6x00xzqq.exepid process 448 tmp6x00xzqq.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 49 ip-api.com -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
tmp6x00xzqq.exepid process 5172 tmp6x00xzqq.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
tmp6x00xzqq.exetmp6x00xzqq.exepid process 448 tmp6x00xzqq.exe 5172 tmp6x00xzqq.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp6x00xzqq.exedescription pid process target process PID 448 set thread context of 5172 448 tmp6x00xzqq.exe tmp6x00xzqq.exe -
Drops file in Windows directory 2 IoCs
Processes:
tmp6x00xzqq.exedescription ioc process File opened for modification C:\Windows\Fonts\humanhood.krs tmp6x00xzqq.exe File opened for modification C:\Windows\resources\0409\stanse\selenitic.imp tmp6x00xzqq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
tmp6x00xzqq.exepid process 5172 tmp6x00xzqq.exe 5172 tmp6x00xzqq.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
tmp6x00xzqq.exepid process 448 tmp6x00xzqq.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
tmp6x00xzqq.exedescription pid process Token: SeDebugPrivilege 5172 tmp6x00xzqq.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
tmp6x00xzqq.exedescription pid process target process PID 448 wrote to memory of 5172 448 tmp6x00xzqq.exe tmp6x00xzqq.exe PID 448 wrote to memory of 5172 448 tmp6x00xzqq.exe tmp6x00xzqq.exe PID 448 wrote to memory of 5172 448 tmp6x00xzqq.exe tmp6x00xzqq.exe PID 448 wrote to memory of 5172 448 tmp6x00xzqq.exe tmp6x00xzqq.exe PID 448 wrote to memory of 5172 448 tmp6x00xzqq.exe tmp6x00xzqq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp6x00xzqq.exe"C:\Users\Admin\AppData\Local\Temp\tmp6x00xzqq.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp6x00xzqq.exe"C:\Users\Admin\AppData\Local\Temp\tmp6x00xzqq.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsd3588.tmp\System.dllFilesize
11KB
MD50ff2d70cfdc8095ea99ca2dabbec3cd7
SHA110c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA256982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
SHA512cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
-
memory/448-19-0x0000000002AF0000-0x0000000004BA9000-memory.dmpFilesize
32.7MB
-
memory/448-9-0x0000000002AF0000-0x0000000004BA9000-memory.dmpFilesize
32.7MB
-
memory/448-10-0x0000000076EA1000-0x0000000076FC1000-memory.dmpFilesize
1.1MB
-
memory/448-11-0x0000000010004000-0x0000000010005000-memory.dmpFilesize
4KB
-
memory/448-13-0x0000000002AF0000-0x0000000004BA9000-memory.dmpFilesize
32.7MB
-
memory/5172-12-0x0000000001740000-0x00000000037F9000-memory.dmpFilesize
32.7MB
-
memory/5172-18-0x00000000004E0000-0x0000000001734000-memory.dmpFilesize
18.3MB
-
memory/5172-14-0x00000000004E0000-0x0000000001734000-memory.dmpFilesize
18.3MB
-
memory/5172-20-0x00000000004E0000-0x0000000000522000-memory.dmpFilesize
264KB
-
memory/5172-21-0x0000000036520000-0x0000000036AC4000-memory.dmpFilesize
5.6MB
-
memory/5172-22-0x0000000034150000-0x00000000341B6000-memory.dmpFilesize
408KB
-
memory/5172-24-0x0000000037250000-0x00000000372A0000-memory.dmpFilesize
320KB
-
memory/5172-25-0x00000000372A0000-0x0000000037332000-memory.dmpFilesize
584KB
-
memory/5172-26-0x0000000037340000-0x000000003734A000-memory.dmpFilesize
40KB
-
memory/5172-27-0x0000000001740000-0x00000000037F9000-memory.dmpFilesize
32.7MB