Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 09:51

General

  • Target

    quotationsheet.exe

  • Size

    703KB

  • MD5

    d1e338f0c608088b7b5aa2e20c3df8ca

  • SHA1

    e27a61a67b4c103595135df9567cac7152d93765

  • SHA256

    d3b852f73cf956335e5cd16bcf94d255065c04b13dc9efb34fe52fdfe6ffed2d

  • SHA512

    2664e688950b24991784c62c7e898f23d4d95b8847122add721ce1e88030b84456c54394ea23488d840009a74032d799db004af9ffe9e352f5abb02061ca9b97

  • SSDEEP

    12288:nbhdAAU3oYkb4oGrX52fAXAxySliLh4oIhoBIBAjdHU5TCsnX+phDqM9FDv:nHAZo1FiJWAQGLCoIK6AFiGsO7D9v

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7225809616:AAEt7H1sHiGor6_FJDBNVWoXF_3jTIBVboA/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\quotationsheet.exe
    "C:\Users\Admin\AppData\Local\Temp\quotationsheet.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      2⤵
        PID:2992
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
        2⤵
          PID:1208
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2568
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
          2⤵
            PID:2744

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2568-22-0x0000000073F9E000-0x0000000073F9F000-memory.dmp

          Filesize

          4KB

        • memory/2568-19-0x0000000000400000-0x0000000000444000-memory.dmp

          Filesize

          272KB

        • memory/2568-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2568-26-0x0000000073F90000-0x000000007467E000-memory.dmp

          Filesize

          6.9MB

        • memory/2568-17-0x0000000000400000-0x0000000000444000-memory.dmp

          Filesize

          272KB

        • memory/2568-25-0x0000000073F9E000-0x0000000073F9F000-memory.dmp

          Filesize

          4KB

        • memory/2568-24-0x0000000073F90000-0x000000007467E000-memory.dmp

          Filesize

          6.9MB

        • memory/2568-21-0x0000000000400000-0x0000000000444000-memory.dmp

          Filesize

          272KB

        • memory/2992-5-0x0000000000400000-0x0000000000444000-memory.dmp

          Filesize

          272KB

        • memory/2992-4-0x0000000000400000-0x0000000000444000-memory.dmp

          Filesize

          272KB

        • memory/2992-6-0x0000000000400000-0x0000000000444000-memory.dmp

          Filesize

          272KB

        • memory/2992-8-0x0000000000400000-0x0000000000444000-memory.dmp

          Filesize

          272KB

        • memory/3000-1-0x00000000008D0000-0x00000000008F2000-memory.dmp

          Filesize

          136KB

        • memory/3000-2-0x000007FEF5290000-0x000007FEF5C7C000-memory.dmp

          Filesize

          9.9MB

        • memory/3000-0-0x000007FEF5293000-0x000007FEF5294000-memory.dmp

          Filesize

          4KB

        • memory/3000-23-0x000007FEF5290000-0x000007FEF5C7C000-memory.dmp

          Filesize

          9.9MB

        • memory/3000-3-0x000000001B4E0000-0x000000001B576000-memory.dmp

          Filesize

          600KB