Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    12-06-2024 02:03

General

  • Target

    42e3b2ce8e78b6721ad3ac1caa5f414ead96ead4fb6d5d1056e714aee0f7cf2a.exe

  • Size

    858KB

  • MD5

    1ce395998c4fc29ef8181e1bdfd4995a

  • SHA1

    567c22d1108055ffd211aac09be440eb3fdc5a72

  • SHA256

    42e3b2ce8e78b6721ad3ac1caa5f414ead96ead4fb6d5d1056e714aee0f7cf2a

  • SHA512

    7febf08a4d21281a0034939e51dad5c977f6691eec43990ba1b91b5076efb249626c2f0edad3bc17805dfb222f6aa724c12701a3292153200ad9fa034c9e535e

  • SSDEEP

    24576:wg61jjk0LAta9At1DIBYa+LzZNEMwh1nRNk6i1BNhFTFNE6:1gYvpNcnIjNjP

Malware Config

Extracted

Family

agenttesla

C2

https://discord.com/api/webhooks/1249924060293632151/QMjg3J31H0YbZihxAt9MK8CN9L8oXRBm5QH8cu1rT1NuNFC1QNYkAYBuPCMCgJyDiCwQ

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42e3b2ce8e78b6721ad3ac1caa5f414ead96ead4fb6d5d1056e714aee0f7cf2a.exe
    "C:\Users\Admin\AppData\Local\Temp\42e3b2ce8e78b6721ad3ac1caa5f414ead96ead4fb6d5d1056e714aee0f7cf2a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Users\Admin\AppData\Local\Temp\42e3b2ce8e78b6721ad3ac1caa5f414ead96ead4fb6d5d1056e714aee0f7cf2a.exe
      "C:\Users\Admin\AppData\Local\Temp\42e3b2ce8e78b6721ad3ac1caa5f414ead96ead4fb6d5d1056e714aee0f7cf2a.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2280

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2220-0-0x00000000741CE000-0x00000000741CF000-memory.dmp

    Filesize

    4KB

  • memory/2220-1-0x0000000001170000-0x000000000124E000-memory.dmp

    Filesize

    888KB

  • memory/2220-2-0x00000000741C0000-0x00000000748AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2220-3-0x00000000008E0000-0x00000000008FA000-memory.dmp

    Filesize

    104KB

  • memory/2220-4-0x0000000000860000-0x0000000000870000-memory.dmp

    Filesize

    64KB

  • memory/2220-5-0x0000000005CF0000-0x0000000005D74000-memory.dmp

    Filesize

    528KB

  • memory/2220-22-0x00000000741C0000-0x00000000748AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2280-18-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2280-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2280-16-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2280-12-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2280-10-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2280-20-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2280-8-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2280-6-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2280-21-0x00000000741C0000-0x00000000748AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2280-23-0x00000000741C0000-0x00000000748AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2280-24-0x00000000741C0000-0x00000000748AE000-memory.dmp

    Filesize

    6.9MB