Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 09:51

General

  • Target

    quotationsheet.exe

  • Size

    703KB

  • MD5

    d1e338f0c608088b7b5aa2e20c3df8ca

  • SHA1

    e27a61a67b4c103595135df9567cac7152d93765

  • SHA256

    d3b852f73cf956335e5cd16bcf94d255065c04b13dc9efb34fe52fdfe6ffed2d

  • SHA512

    2664e688950b24991784c62c7e898f23d4d95b8847122add721ce1e88030b84456c54394ea23488d840009a74032d799db004af9ffe9e352f5abb02061ca9b97

  • SSDEEP

    12288:nbhdAAU3oYkb4oGrX52fAXAxySliLh4oIhoBIBAjdHU5TCsnX+phDqM9FDv:nHAZo1FiJWAQGLCoIK6AFiGsO7D9v

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7225809616:AAEt7H1sHiGor6_FJDBNVWoXF_3jTIBVboA/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\quotationsheet.exe
    "C:\Users\Admin\AppData\Local\Temp\quotationsheet.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4080
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
      2⤵
        PID:2860
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
        2⤵
          PID:1796
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:3684
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
          2⤵
            PID:4456

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3684-8-0x00000000749E0000-0x0000000075190000-memory.dmp

          Filesize

          7.7MB

        • memory/3684-10-0x0000000006BE0000-0x0000000006C30000-memory.dmp

          Filesize

          320KB

        • memory/3684-15-0x00000000749E0000-0x0000000075190000-memory.dmp

          Filesize

          7.7MB

        • memory/3684-14-0x00000000749EE000-0x00000000749EF000-memory.dmp

          Filesize

          4KB

        • memory/3684-13-0x0000000006F40000-0x0000000006F4A000-memory.dmp

          Filesize

          40KB

        • memory/3684-5-0x00000000749EE000-0x00000000749EF000-memory.dmp

          Filesize

          4KB

        • memory/3684-12-0x0000000006D70000-0x0000000006E02000-memory.dmp

          Filesize

          584KB

        • memory/3684-6-0x0000000005DB0000-0x0000000006354000-memory.dmp

          Filesize

          5.6MB

        • memory/3684-4-0x0000000000400000-0x0000000000444000-memory.dmp

          Filesize

          272KB

        • memory/3684-11-0x0000000006CD0000-0x0000000006D6C000-memory.dmp

          Filesize

          624KB

        • memory/3684-7-0x0000000005900000-0x0000000005966000-memory.dmp

          Filesize

          408KB

        • memory/4080-9-0x00007FFC73A80000-0x00007FFC74541000-memory.dmp

          Filesize

          10.8MB

        • memory/4080-0-0x00000226FFE00000-0x00000226FFE22000-memory.dmp

          Filesize

          136KB

        • memory/4080-1-0x00007FFC73A83000-0x00007FFC73A85000-memory.dmp

          Filesize

          8KB

        • memory/4080-3-0x00007FFC73A80000-0x00007FFC74541000-memory.dmp

          Filesize

          10.8MB

        • memory/4080-2-0x000002269A5C0000-0x000002269A656000-memory.dmp

          Filesize

          600KB