Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 01:43
Static task
static1
Behavioral task
behavioral1
Sample
45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4.exe
Resource
win10v2004-20240426-en
General
-
Target
45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4.exe
-
Size
716KB
-
MD5
64605be9d007ce3a0d7be5c2ac52b5bc
-
SHA1
194b675d43243d9bc0826a6557018608e8fd1f39
-
SHA256
45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4
-
SHA512
b21fe3495cdcca49f19ffea6fbb72d2e3e168ae9feffaf47464b6221b51373bb188bdae05acad5165d94a8462b592c8f6d999db4e73e4dea9a39ea1ef9f0d19a
-
SSDEEP
12288:zUQKt/rFfamKYqmdB9W1ZvuzxbWFBXOixQVHjJQ45vpSZ9qGdAJXAeYMxa/1mPfy:YQKN5imhqmP9KCoF9ED+gRS/wwh1F
Malware Config
Extracted
Protocol: smtp- Host:
mail.ayrancimetal.com - Port:
587 - Username:
[email protected] - Password:
CEBrPMJuCWPcB8xSLQnf
Extracted
agenttesla
Protocol: smtp- Host:
mail.ayrancimetal.com - Port:
587 - Username:
[email protected] - Password:
CEBrPMJuCWPcB8xSLQnf - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TpAXVRH = "C:\\Users\\Admin\\AppData\\Roaming\\TpAXVRH\\TpAXVRH.exe" 45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4.exepid Process 4840 45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4.exe 4840 45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4.exedescription pid Process Token: SeDebugPrivilege 4840 45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4.exe"C:\Users\Admin\AppData\Local\Temp\45872d8b2804fd2b809569480350f98cac1816c19cc9d5aa25614d556f6e5db4.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4840