Analysis
- max time kernel
93s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
17/06/2024, 01:14
General
- Target b8c81808e93351d18459cd2811bfcc52857914d604aa9a6eafdd23ca0b8c64fc.exe
- Size 656KB
- Sample240617-blxqdsxdnc
- SHA256 b8c81808e93351d18459cd2811bfcc52857914d604aa9a6eafdd23ca0b8c64fc
Malware Config
Extracted
-
Protocol
ftp
-
Host
ftp.midhcodistribuciones.com
-
Port
21
-
Username
-
Password
,A7}+JV4KExQ
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.midhcodistribuciones.com
-
Port
21
-
Username
-
Password
,A7}+JV4KExQ
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8c81808e93351d18459cd2811bfcc52857914d604aa9a6eafdd23ca0b8c64fc.exe"C:\Users\Admin\AppData\Local\Temp\b8c81808e93351d18459cd2811bfcc52857914d604aa9a6eafdd23ca0b8c64fc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b8c81808e93351d18459cd2811bfcc52857914d604aa9a6eafdd23ca0b8c64fc.exe"C:\Users\Admin\AppData\Local\Temp\b8c81808e93351d18459cd2811bfcc52857914d604aa9a6eafdd23ca0b8c64fc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
b8c81808e93351d18459cd2811bfcc52857914d604aa9a6eafdd23ca0b8c64fc.exe.log
memory/3216-10-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3216-18-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/3216-17-0x00000000064A0000-0x00000000064F0000-memory.dmp
memory/3216-16-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/3216-15-0x0000000004DE0000-0x0000000004E46000-memory.dmp
memory/3216-13-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/4660-4-0x0000000004EE0000-0x0000000004EEA000-memory.dmp
memory/4660-8-0x0000000006390000-0x0000000006412000-memory.dmp
memory/4660-9-0x00000000089D0000-0x0000000008A6C000-memory.dmp
memory/4660-7-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/4660-6-0x0000000006370000-0x000000000638A000-memory.dmp
memory/4660-5-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/4660-14-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/4660-0-0x0000000074BDE000-0x0000000074BDF000-memory.dmp
memory/4660-3-0x0000000004D10000-0x0000000004DA2000-memory.dmp
memory/4660-2-0x00000000051C0000-0x0000000005764000-memory.dmp
memory/4660-1-0x00000000003C0000-0x000000000046A000-memory.dmp