Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 02:03

General

  • Target

    42e3b2ce8e78b6721ad3ac1caa5f414ead96ead4fb6d5d1056e714aee0f7cf2a.exe

  • Size

    858KB

  • MD5

    1ce395998c4fc29ef8181e1bdfd4995a

  • SHA1

    567c22d1108055ffd211aac09be440eb3fdc5a72

  • SHA256

    42e3b2ce8e78b6721ad3ac1caa5f414ead96ead4fb6d5d1056e714aee0f7cf2a

  • SHA512

    7febf08a4d21281a0034939e51dad5c977f6691eec43990ba1b91b5076efb249626c2f0edad3bc17805dfb222f6aa724c12701a3292153200ad9fa034c9e535e

  • SSDEEP

    24576:wg61jjk0LAta9At1DIBYa+LzZNEMwh1nRNk6i1BNhFTFNE6:1gYvpNcnIjNjP

Malware Config

Extracted

Family

agenttesla

C2

https://discord.com/api/webhooks/1249924060293632151/QMjg3J31H0YbZihxAt9MK8CN9L8oXRBm5QH8cu1rT1NuNFC1QNYkAYBuPCMCgJyDiCwQ

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42e3b2ce8e78b6721ad3ac1caa5f414ead96ead4fb6d5d1056e714aee0f7cf2a.exe
    "C:\Users\Admin\AppData\Local\Temp\42e3b2ce8e78b6721ad3ac1caa5f414ead96ead4fb6d5d1056e714aee0f7cf2a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4856
    • C:\Users\Admin\AppData\Local\Temp\42e3b2ce8e78b6721ad3ac1caa5f414ead96ead4fb6d5d1056e714aee0f7cf2a.exe
      "C:\Users\Admin\AppData\Local\Temp\42e3b2ce8e78b6721ad3ac1caa5f414ead96ead4fb6d5d1056e714aee0f7cf2a.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4736
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 2040
        3⤵
        • Program crash
        PID:4992
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4736 -ip 4736
    1⤵
      PID:4088

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4736-10-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/4736-17-0x00000000750A0000-0x0000000075850000-memory.dmp

      Filesize

      7.7MB

    • memory/4736-16-0x0000000006000000-0x0000000006050000-memory.dmp

      Filesize

      320KB

    • memory/4736-15-0x00000000750A0000-0x0000000075850000-memory.dmp

      Filesize

      7.7MB

    • memory/4736-14-0x00000000750A0000-0x0000000075850000-memory.dmp

      Filesize

      7.7MB

    • memory/4736-13-0x0000000005320000-0x0000000005386000-memory.dmp

      Filesize

      408KB

    • memory/4856-4-0x0000000005460000-0x000000000546A000-memory.dmp

      Filesize

      40KB

    • memory/4856-7-0x0000000006610000-0x0000000006620000-memory.dmp

      Filesize

      64KB

    • memory/4856-8-0x0000000008160000-0x00000000081E4000-memory.dmp

      Filesize

      528KB

    • memory/4856-9-0x000000000A8E0000-0x000000000A97C000-memory.dmp

      Filesize

      624KB

    • memory/4856-6-0x0000000008140000-0x000000000815A000-memory.dmp

      Filesize

      104KB

    • memory/4856-12-0x00000000750A0000-0x0000000075850000-memory.dmp

      Filesize

      7.7MB

    • memory/4856-5-0x00000000750A0000-0x0000000075850000-memory.dmp

      Filesize

      7.7MB

    • memory/4856-0-0x00000000750AE000-0x00000000750AF000-memory.dmp

      Filesize

      4KB

    • memory/4856-3-0x00000000053C0000-0x0000000005452000-memory.dmp

      Filesize

      584KB

    • memory/4856-2-0x0000000005A60000-0x0000000006004000-memory.dmp

      Filesize

      5.6MB

    • memory/4856-1-0x00000000008F0000-0x00000000009CE000-memory.dmp

      Filesize

      888KB