Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2024 01:01

General

  • Target

    71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe

  • Size

    196KB

  • MD5

    06f89bea6cec0ee3459c26732c6f4d40

  • SHA1

    077c773301223d98b07630487facd24710353335

  • SHA256

    71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d

  • SHA512

    a172753e363467928c9bf700f36865eb53ab5ea85dcbf7bb3fa8bc756f130eacf3ba194f8b25707203b55e8b84a256f756e27a17cce4f81991e9cc2c31353d6b

  • SSDEEP

    3072:gpFMiA1m+CfRqBpLd0aTUWs+zZl1/eSFZQ0xw5W1LvTFH:gpfqRCfsppZlBvvw5WNRH

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Family

xworm

Version

5.0

C2

178.215.236.251:717

Mutex

0AVeWj1eTvHM3Un2

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

  • telegram

    https://api.telegram.org/bot5987023205:AAFlvwKv3zD3wQ2CQAewIB6uU95uBQ25ip0/sendMessage?chat_id=5202962680

aes.plain

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect Xworm Payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe
    "C:\Users\Admin\AppData\Local\Temp\71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
      "C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:928
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Drops startup file
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4400
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3308

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe

    Filesize

    195KB

    MD5

    f3578e8755842b11168c9cfe8d72f51e

    SHA1

    5973e517739c944d5e1e269f399e7bebf33fd172

    SHA256

    2376cb21ed4b8e05774a49512f21e1f4d3ca960df5d74865786774d000481f5b

    SHA512

    48b2ed8fe52bdf97d5be0d8ea75c1e4243ee2e282240041e7b7715db8dad4c5d3457a270d4b4b006b56a0641b839e54a24a879ddb4526e5e961d8700829d3a29

  • \??\c:\users\admin\appdata\roaming\findo.exe

    Filesize

    196KB

    MD5

    06f89bea6cec0ee3459c26732c6f4d40

    SHA1

    077c773301223d98b07630487facd24710353335

    SHA256

    71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d

    SHA512

    a172753e363467928c9bf700f36865eb53ab5ea85dcbf7bb3fa8bc756f130eacf3ba194f8b25707203b55e8b84a256f756e27a17cce4f81991e9cc2c31353d6b

  • memory/928-9812-0x0000000074F50000-0x0000000075700000-memory.dmp

    Filesize

    7.7MB

  • memory/928-9806-0x0000000074F50000-0x0000000075700000-memory.dmp

    Filesize

    7.7MB

  • memory/928-9805-0x00000000058A0000-0x00000000058FC000-memory.dmp

    Filesize

    368KB

  • memory/928-4918-0x0000000005F50000-0x0000000006170000-memory.dmp

    Filesize

    2.1MB

  • memory/928-4910-0x0000000074F50000-0x0000000075700000-memory.dmp

    Filesize

    7.7MB

  • memory/928-4908-0x00000000005B0000-0x00000000005E2000-memory.dmp

    Filesize

    200KB

  • memory/1348-65-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-21-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-25-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-59-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-63-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-69-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-67-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-0-0x0000000074F5E000-0x0000000074F5F000-memory.dmp

    Filesize

    4KB

  • memory/1348-61-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-53-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-51-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-49-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-57-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-55-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-47-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-45-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-43-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-41-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-39-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-37-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-35-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-33-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-31-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-28-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-23-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-29-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-19-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-17-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-15-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-7-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-6-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-4892-0x0000000074F50000-0x0000000075700000-memory.dmp

    Filesize

    7.7MB

  • memory/1348-4893-0x0000000005D10000-0x0000000005D92000-memory.dmp

    Filesize

    520KB

  • memory/1348-4894-0x0000000005E60000-0x0000000005EAC000-memory.dmp

    Filesize

    304KB

  • memory/1348-4895-0x0000000006450000-0x00000000064B6000-memory.dmp

    Filesize

    408KB

  • memory/1348-9-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-4907-0x0000000006AC0000-0x0000000006B14000-memory.dmp

    Filesize

    336KB

  • memory/1348-11-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-13-0x0000000006550000-0x0000000006790000-memory.dmp

    Filesize

    2.2MB

  • memory/1348-4913-0x0000000074F50000-0x0000000075700000-memory.dmp

    Filesize

    7.7MB

  • memory/1348-1-0x0000000000A70000-0x0000000000AA4000-memory.dmp

    Filesize

    208KB

  • memory/1348-2-0x0000000074F50000-0x0000000075700000-memory.dmp

    Filesize

    7.7MB

  • memory/1348-3-0x0000000006550000-0x0000000006796000-memory.dmp

    Filesize

    2.3MB

  • memory/1348-4-0x0000000006D40000-0x00000000072E4000-memory.dmp

    Filesize

    5.6MB

  • memory/1348-5-0x0000000006890000-0x0000000006922000-memory.dmp

    Filesize

    584KB

  • memory/3308-4917-0x0000000006D30000-0x0000000006D3A000-memory.dmp

    Filesize

    40KB

  • memory/3308-4916-0x0000000006CC0000-0x0000000006D10000-memory.dmp

    Filesize

    320KB

  • memory/3308-9807-0x0000000074F50000-0x0000000075700000-memory.dmp

    Filesize

    7.7MB

  • memory/3308-4914-0x0000000074F50000-0x0000000075700000-memory.dmp

    Filesize

    7.7MB

  • memory/3308-4915-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/4400-9813-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/4400-9814-0x0000000004E50000-0x0000000004EEC000-memory.dmp

    Filesize

    624KB