Analysis

  • max time kernel
    142s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 09:51

General

  • Target

    PO76389.exe

  • Size

    851KB

  • MD5

    b78a41cfedbd72be9cda0c2e8b456b9b

  • SHA1

    842a457a15cd9b35c930e86aa3adca801231c0c9

  • SHA256

    b43813d1e597a0633fc8693d5921688a8b189cfdc6c74fda22e42c2aefa3270c

  • SHA512

    2511b4647e030b02b3441fdf17259fa49547dead3c3b19d4a8bd04b1825d5bbe464d00cee273bd35f06a14bb66c135453e8d381bdf2b8c0fc2d5e5ba5edaecee

  • SSDEEP

    12288:PMYeaky/Qa0KP1x+kPwu9JaGYd89Lt/rFfaolj2YqEvlw7KZNy6XXSJFY/SYwkiN:PMYej0N5iYKR6XXSvY/STixHu9Iif

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.psgrasa.ir
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    mahsa730101

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO76389.exe
    "C:\Users\Admin\AppData\Local\Temp\PO76389.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Users\Admin\AppData\Local\Temp\PO76389.exe
      "C:\Users\Admin\AppData\Local\Temp\PO76389.exe"
      2⤵
        PID:1624
      • C:\Users\Admin\AppData\Local\Temp\PO76389.exe
        "C:\Users\Admin\AppData\Local\Temp\PO76389.exe"
        2⤵
          PID:3156
        • C:\Users\Admin\AppData\Local\Temp\PO76389.exe
          "C:\Users\Admin\AppData\Local\Temp\PO76389.exe"
          2⤵
            PID:2096
          • C:\Users\Admin\AppData\Local\Temp\PO76389.exe
            "C:\Users\Admin\AppData\Local\Temp\PO76389.exe"
            2⤵
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2968
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3612 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:4156

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO76389.exe.log

            Filesize

            1KB

            MD5

            b7b9acb869ccc7f7ecb5304ec0384dee

            SHA1

            6a90751c95817903ee833d59a0abbef425a613b3

            SHA256

            8cb00a15cd942a1861c573d86d6fb430512c8e2f80f6349f48b16b8709ca7aa4

            SHA512

            7bec881ac5f59ac26f1be1e7e26d63f040c06369de10c1c246e531a4395d27c335d9acc647ecdedb48ed37bdc2dc405a4cfc11762e1c00659a49be259eaf8764

          • memory/2968-12-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/2968-21-0x0000000074A40000-0x00000000751F0000-memory.dmp

            Filesize

            7.7MB

          • memory/2968-20-0x0000000006610000-0x0000000006660000-memory.dmp

            Filesize

            320KB

          • memory/2968-17-0x0000000074A40000-0x00000000751F0000-memory.dmp

            Filesize

            7.7MB

          • memory/2968-18-0x0000000005120000-0x0000000005186000-memory.dmp

            Filesize

            408KB

          • memory/2968-15-0x0000000074A40000-0x00000000751F0000-memory.dmp

            Filesize

            7.7MB

          • memory/3012-10-0x0000000006760000-0x00000000067E4000-memory.dmp

            Filesize

            528KB

          • memory/3012-8-0x00000000066E0000-0x00000000066EE000-memory.dmp

            Filesize

            56KB

          • memory/3012-9-0x00000000066F0000-0x0000000006700000-memory.dmp

            Filesize

            64KB

          • memory/3012-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

            Filesize

            4KB

          • memory/3012-11-0x0000000008E60000-0x0000000008EFC000-memory.dmp

            Filesize

            624KB

          • memory/3012-7-0x00000000066C0000-0x00000000066D6000-memory.dmp

            Filesize

            88KB

          • memory/3012-6-0x0000000004EC0000-0x0000000004ECA000-memory.dmp

            Filesize

            40KB

          • memory/3012-5-0x0000000074A40000-0x00000000751F0000-memory.dmp

            Filesize

            7.7MB

          • memory/3012-16-0x0000000074A40000-0x00000000751F0000-memory.dmp

            Filesize

            7.7MB

          • memory/3012-4-0x0000000005660000-0x00000000059B4000-memory.dmp

            Filesize

            3.3MB

          • memory/3012-3-0x0000000004C00000-0x0000000004C92000-memory.dmp

            Filesize

            584KB

          • memory/3012-2-0x00000000050B0000-0x0000000005654000-memory.dmp

            Filesize

            5.6MB

          • memory/3012-1-0x0000000000140000-0x000000000021A000-memory.dmp

            Filesize

            872KB