Analysis

  • max time kernel
    118s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 02:00

General

  • Target

    afb9b832b61a4c5152e1747afaed615fdfb2d79d42c4bc683ade8c0de25cde8d.exe

  • Size

    695KB

  • MD5

    7a43598ff7b62a711389146aa6bd97aa

  • SHA1

    2855cb5c847938704dcae39267cff76cdc50c647

  • SHA256

    afb9b832b61a4c5152e1747afaed615fdfb2d79d42c4bc683ade8c0de25cde8d

  • SHA512

    f418d43d2e7a0b23fb3e509d6903b3d5e4fd12b37f0bd573ab84d1db51889f57488aa913ae88db3a2e3cfeb957e7ff969d358a37c793c9a703450607802a126d

  • SSDEEP

    12288:4W/RA5STkep6Mlqnl3LkcBDVXFamBD/UFHn0+HrBSxF6w7RTIYDX:4Mm5SH6MIl3LkGDhsmD/U0WO7xIc

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.svetigeorgije.co.rs
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    4c5H&b2whkD9

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\afb9b832b61a4c5152e1747afaed615fdfb2d79d42c4bc683ade8c0de25cde8d.exe
    "C:\Users\Admin\AppData\Local\Temp\afb9b832b61a4c5152e1747afaed615fdfb2d79d42c4bc683ade8c0de25cde8d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3392
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2660-12-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2660-20-0x0000000074740000-0x0000000074EF0000-memory.dmp

    Filesize

    7.7MB

  • memory/2660-19-0x00000000065E0000-0x00000000067A2000-memory.dmp

    Filesize

    1.8MB

  • memory/2660-18-0x00000000063C0000-0x0000000006410000-memory.dmp

    Filesize

    320KB

  • memory/2660-17-0x0000000074740000-0x0000000074EF0000-memory.dmp

    Filesize

    7.7MB

  • memory/2660-16-0x0000000005010000-0x0000000005076000-memory.dmp

    Filesize

    408KB

  • memory/2660-15-0x0000000074740000-0x0000000074EF0000-memory.dmp

    Filesize

    7.7MB

  • memory/3392-5-0x0000000074740000-0x0000000074EF0000-memory.dmp

    Filesize

    7.7MB

  • memory/3392-8-0x00000000062A0000-0x00000000062AA000-memory.dmp

    Filesize

    40KB

  • memory/3392-9-0x0000000074740000-0x0000000074EF0000-memory.dmp

    Filesize

    7.7MB

  • memory/3392-10-0x0000000006E10000-0x0000000006E2A000-memory.dmp

    Filesize

    104KB

  • memory/3392-11-0x00000000072E0000-0x00000000072E6000-memory.dmp

    Filesize

    24KB

  • memory/3392-7-0x0000000006140000-0x0000000006184000-memory.dmp

    Filesize

    272KB

  • memory/3392-6-0x0000000074740000-0x0000000074EF0000-memory.dmp

    Filesize

    7.7MB

  • memory/3392-14-0x0000000074740000-0x0000000074EF0000-memory.dmp

    Filesize

    7.7MB

  • memory/3392-0-0x000000007474E000-0x000000007474F000-memory.dmp

    Filesize

    4KB

  • memory/3392-4-0x0000000005000000-0x000000000509C000-memory.dmp

    Filesize

    624KB

  • memory/3392-3-0x0000000004F60000-0x0000000004FF2000-memory.dmp

    Filesize

    584KB

  • memory/3392-2-0x0000000005510000-0x0000000005AB4000-memory.dmp

    Filesize

    5.6MB

  • memory/3392-1-0x00000000007F0000-0x00000000008A4000-memory.dmp

    Filesize

    720KB