Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 01:41
Static task
static1
Behavioral task
behavioral1
Sample
f00296fec9d54ed5693e376ca6bc46ff9705a56bd3cd7666ae86925b31064ab6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f00296fec9d54ed5693e376ca6bc46ff9705a56bd3cd7666ae86925b31064ab6.exe
Resource
win10v2004-20240426-en
General
-
Target
f00296fec9d54ed5693e376ca6bc46ff9705a56bd3cd7666ae86925b31064ab6.exe
-
Size
717KB
-
MD5
546416358c4287c392ee1c402eaa5a10
-
SHA1
c226e61aa6c39fcaf36a16ef6c306759ce14b6e4
-
SHA256
f00296fec9d54ed5693e376ca6bc46ff9705a56bd3cd7666ae86925b31064ab6
-
SHA512
6576d268af53077f88d5f014ade2d454517912a01e7ee179a4e1ad505084a2beb6ec19edd02e4ea90592a821455f51a16e830881332ab7b84b8ee7c631a96986
-
SSDEEP
12288:8k7Kt/rFfatT7rbOan1Tm1p9tMfakozXJQZ8PISxvQblqtO4hkR:R7KN5i97Oa16P9jki5QGjvQRqtC
Malware Config
Extracted
Protocol: smtp- Host:
mail.anetospiti.gr - Port:
587 - Username:
[email protected] - Password:
akS3cdj{_L7m
Extracted
agenttesla
Protocol: smtp- Host:
mail.anetospiti.gr - Port:
587 - Username:
[email protected] - Password:
akS3cdj{_L7m - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 30 ip-api.com -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f00296fec9d54ed5693e376ca6bc46ff9705a56bd3cd7666ae86925b31064ab6.exepid Process 5416 f00296fec9d54ed5693e376ca6bc46ff9705a56bd3cd7666ae86925b31064ab6.exe 5416 f00296fec9d54ed5693e376ca6bc46ff9705a56bd3cd7666ae86925b31064ab6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
f00296fec9d54ed5693e376ca6bc46ff9705a56bd3cd7666ae86925b31064ab6.exedescription pid Process Token: SeDebugPrivilege 5416 f00296fec9d54ed5693e376ca6bc46ff9705a56bd3cd7666ae86925b31064ab6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f00296fec9d54ed5693e376ca6bc46ff9705a56bd3cd7666ae86925b31064ab6.exe"C:\Users\Admin\AppData\Local\Temp\f00296fec9d54ed5693e376ca6bc46ff9705a56bd3cd7666ae86925b31064ab6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5416