Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    31-05-2024 01:01

General

  • Target

    71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe

  • Size

    196KB

  • MD5

    06f89bea6cec0ee3459c26732c6f4d40

  • SHA1

    077c773301223d98b07630487facd24710353335

  • SHA256

    71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d

  • SHA512

    a172753e363467928c9bf700f36865eb53ab5ea85dcbf7bb3fa8bc756f130eacf3ba194f8b25707203b55e8b84a256f756e27a17cce4f81991e9cc2c31353d6b

  • SSDEEP

    3072:gpFMiA1m+CfRqBpLd0aTUWs+zZl1/eSFZQ0xw5W1LvTFH:gpfqRCfsppZlBvvw5WNRH

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Family

xworm

Version

5.0

C2

178.215.236.251:717

Mutex

0AVeWj1eTvHM3Un2

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

  • telegram

    https://api.telegram.org/bot5987023205:AAFlvwKv3zD3wQ2CQAewIB6uU95uBQ25ip0/sendMessage?chat_id=5202962680

aes.plain

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe
    "C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1904
    • C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
      "C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3192
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Drops startup file
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1160
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \??\c:\users\admin\appdata\roaming\findo.exe

    Filesize

    195KB

    MD5

    9d4dcf280bb10cd4bd030bfd87b14ff9

    SHA1

    20393d494e912ddea7036d95963f9783e40f7462

    SHA256

    2c256b37acab51690ca4d1e6cfe3cb74e421f7fbff011a2d29b4c3f406961181

    SHA512

    8d1205220d6bc09d44a0601ffd7535dfe4b76eb685b3a49cee9db0c74ea72c59ccb15f9c10a33004ec5e1fc3af2f7a66f2cb57fa0f7a873d045b8229d09272a5

  • \Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe

    Filesize

    195KB

    MD5

    f3578e8755842b11168c9cfe8d72f51e

    SHA1

    5973e517739c944d5e1e269f399e7bebf33fd172

    SHA256

    2376cb21ed4b8e05774a49512f21e1f4d3ca960df5d74865786774d000481f5b

    SHA512

    48b2ed8fe52bdf97d5be0d8ea75c1e4243ee2e282240041e7b7715db8dad4c5d3457a270d4b4b006b56a0641b839e54a24a879ddb4526e5e961d8700829d3a29

  • \Users\Admin\AppData\Roaming\XClient.exe

    Filesize

    63KB

    MD5

    b58b926c3574d28d5b7fdd2ca3ec30d5

    SHA1

    d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

    SHA256

    6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

    SHA512

    b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

  • memory/1160-9823-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/1904-49-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-21-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-45-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-27-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-43-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-19-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-17-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-15-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-13-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-11-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-9-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-8-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-41-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-51-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-67-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-39-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-63-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-61-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-59-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-57-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-55-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-53-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-0-0x00000000740DE000-0x00000000740DF000-memory.dmp

    Filesize

    4KB

  • memory/1904-47-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-23-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-5-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-65-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-37-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-35-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-33-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-31-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-29-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-25-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-4890-0x00000000740D0000-0x00000000747BE000-memory.dmp

    Filesize

    6.9MB

  • memory/1904-4891-0x0000000005300000-0x0000000005382000-memory.dmp

    Filesize

    520KB

  • memory/1904-4892-0x0000000004720000-0x000000000476C000-memory.dmp

    Filesize

    304KB

  • memory/1904-4-0x0000000006480000-0x00000000066C0000-memory.dmp

    Filesize

    2.2MB

  • memory/1904-1-0x0000000000990000-0x00000000009C4000-memory.dmp

    Filesize

    208KB

  • memory/1904-4901-0x0000000005DD0000-0x0000000005E24000-memory.dmp

    Filesize

    336KB

  • memory/1904-2-0x00000000740D0000-0x00000000747BE000-memory.dmp

    Filesize

    6.9MB

  • memory/1904-3-0x0000000006480000-0x00000000066C6000-memory.dmp

    Filesize

    2.3MB

  • memory/1904-4918-0x00000000740D0000-0x00000000747BE000-memory.dmp

    Filesize

    6.9MB

  • memory/3192-4920-0x00000000061F0000-0x0000000006410000-memory.dmp

    Filesize

    2.1MB

  • memory/3192-9807-0x0000000005190000-0x00000000051EC000-memory.dmp

    Filesize

    368KB

  • memory/3192-9808-0x00000000740D0000-0x00000000747BE000-memory.dmp

    Filesize

    6.9MB

  • memory/3192-4903-0x00000000740D0000-0x00000000747BE000-memory.dmp

    Filesize

    6.9MB

  • memory/3192-4902-0x00000000740D0000-0x00000000747BE000-memory.dmp

    Filesize

    6.9MB

  • memory/3192-9824-0x00000000740D0000-0x00000000747BE000-memory.dmp

    Filesize

    6.9MB

  • memory/3192-4900-0x0000000000EF0000-0x0000000000F22000-memory.dmp

    Filesize

    200KB

  • memory/3296-4919-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB