Analysis
-
max time kernel
133s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
04-06-2024 13:21
General
-
Target
BRAVE LEADER - VSL's DETAILS.doc.scr
-
Size
762KB
-
MD5
5f897c6d8541b644568c07309597511e
-
SHA1
fd80b0cd2d140fb5913aaededd37cc249f897497
-
SHA256
399e57468e19326fa62e4460a5410c393ff65b9a984c01fcdebed031c51b4168
-
SHA512
62f162e3c0b57cca31ca005e397889b1f5d0fc2d24bb5645a85231da14460d9d0909c96ad2fc53c96fe6ba676bb71cf0931f5542ce645f0c4af5206228082a1f
-
SSDEEP
12288:2cKNr+u9UKTwBtQwt4GaThKS9hGpD+9vBhQcEboEjYD91DpZdcbsv:2bCuuKUBqwt4phKS9AE9vBM0YYDXDS
Malware Config
Extracted
Protocol: ftp- Host:
beirutrest.com - Port:
21 - Username:
[email protected] - Password:
9yXQ39wz(uL+
Extracted
agenttesla
Protocol: ftp- Host:
ftp://beirutrest.com - Port:
21 - Username:
[email protected] - Password:
9yXQ39wz(uL+
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BRAVE LEADER - VSL's DETAILS.doc.scr"C:\Users\Admin\AppData\Local\Temp\BRAVE LEADER - VSL's DETAILS.doc.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BRAVE LEADER - VSL's DETAILS.doc.scr"C:\Users\Admin\AppData\Local\Temp\BRAVE LEADER - VSL's DETAILS.doc.scr"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53c6df815182138b771482782a672d81a
SHA16fd18f15283862a4e9df1234fa82abeccd98e384
SHA256f96db9f49c2ba07ca282dc986077ab03f987183dc595594216c32b887bffa4b0
SHA512150bdfe4fc36538da93346ac18a393c3eb7fec512894e076baf1602f9ff3f4608c624bab808903a1bddce976e4e51aa655ad749422763bf9799b1cec2d064feb
-
Filesize
520KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
88KB
-
Filesize
56KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
4KB
-
Filesize
624KB
-
Filesize
784KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
320KB
-
Filesize
256KB