Analysis

  • max time kernel
    117s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    18-06-2024 09:11

General

  • Target

    QUOTATION_JUNQTRA031244·PDF.scr.exe

  • Size

    2.0MB

  • MD5

    6fed3897ec33eb7c9687521f27230d4f

  • SHA1

    91fe908aaf50fd87341aef1205b011c6f62fee7f

  • SHA256

    12a342b6a487518d9a0bd13adf3503b14b524d712351a48da4a3eea32ea24e40

  • SHA512

    50b8890e609e0044d5a95e255c43772c0a24b80dac86e7980dcd6b2f23a72b518d285d7985d67302c19015c16ceffa70fcad0d14b77a3d3012fcb7ac008a12bd

  • SSDEEP

    24576:rTsNDdDlnAh8b1XX0qIwjERO98EZ7F5jXGYp:rTsNDdZnhyXo5jXL

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\QUOTATION_JUNQTRA031244·PDF.scr.exe
    "C:\Users\Admin\AppData\Local\Temp\QUOTATION_JUNQTRA031244·PDF.scr.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3420

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6065b7f6965f69c712518b9221d0c5ce

    SHA1

    b25cd707bab4df3c8f70c24c4803f250972a0d3f

    SHA256

    aeb3729add2a1698766eca2c9b7ec5f8c1678ca49cbb222cc7f0720c16d7869b

    SHA512

    848847df5800a3fb5a5931d344231e990ac5072ed137863ded6622ac68fef25d8ab87ae4896bbbf0bc764d6c330c15adcde083dfd49f6315d9d3c50d173e165a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    99a9add07b1d4bfb4025488e188eeb5d

    SHA1

    cd281016b510671f76a94be229d2d5ef4a5a2ad8

    SHA256

    6c9c1ffdddfcc313871ca633ebf192da2535a216f8d193c600aca0cb9b016be3

    SHA512

    578304fac3b18617b600f9775781f62b05ab55fdba3e2f2c6f0bda6d8cdfb50607d7c9db74a4c75f71f9f96629abcebbed21895cd7c41e95db2923e6e94d97c4

  • C:\Users\Admin\AppData\Local\Temp\Tar1D84.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/1936-139-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-115-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-2-0x0000000074990000-0x000000007507E000-memory.dmp

    Filesize

    6.9MB

  • memory/1936-113-0x0000000008200000-0x0000000008432000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-129-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-114-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-153-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-119-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-123-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-127-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-125-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-157-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-133-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-131-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-121-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-117-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-143-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-149-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-155-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-137-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-151-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-0-0x000000007499E000-0x000000007499F000-memory.dmp

    Filesize

    4KB

  • memory/1936-141-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-147-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-171-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-1-0x0000000001320000-0x000000000152C000-memory.dmp

    Filesize

    2.0MB

  • memory/1936-135-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-175-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-177-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-173-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-169-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-167-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-165-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-163-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-161-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-159-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-145-0x0000000008200000-0x000000000842C000-memory.dmp

    Filesize

    2.2MB

  • memory/1936-5000-0x0000000074990000-0x000000007507E000-memory.dmp

    Filesize

    6.9MB

  • memory/1936-5002-0x00000000012D0000-0x000000000131C000-memory.dmp

    Filesize

    304KB

  • memory/1936-5001-0x0000000005A30000-0x0000000005A9C000-memory.dmp

    Filesize

    432KB

  • memory/1936-5003-0x000000007499E000-0x000000007499F000-memory.dmp

    Filesize

    4KB

  • memory/1936-5004-0x0000000074990000-0x000000007507E000-memory.dmp

    Filesize

    6.9MB

  • memory/1936-5005-0x0000000074990000-0x000000007507E000-memory.dmp

    Filesize

    6.9MB

  • memory/1936-5006-0x00000000054D0000-0x0000000005524000-memory.dmp

    Filesize

    336KB

  • memory/1936-5025-0x0000000074990000-0x000000007507E000-memory.dmp

    Filesize

    6.9MB

  • memory/3420-5024-0x0000000000080000-0x00000000000C2000-memory.dmp

    Filesize

    264KB

  • memory/3420-5026-0x0000000074990000-0x000000007507E000-memory.dmp

    Filesize

    6.9MB

  • memory/3420-5027-0x0000000074990000-0x000000007507E000-memory.dmp

    Filesize

    6.9MB

  • memory/3420-5028-0x0000000074990000-0x000000007507E000-memory.dmp

    Filesize

    6.9MB