Analysis

  • max time kernel
    142s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-06-2024 09:11

General

  • Target

    QUOTATION_JUNQTRA031244úPDF.scr

  • Size

    2.0MB

  • MD5

    6fed3897ec33eb7c9687521f27230d4f

  • SHA1

    91fe908aaf50fd87341aef1205b011c6f62fee7f

  • SHA256

    12a342b6a487518d9a0bd13adf3503b14b524d712351a48da4a3eea32ea24e40

  • SHA512

    50b8890e609e0044d5a95e255c43772c0a24b80dac86e7980dcd6b2f23a72b518d285d7985d67302c19015c16ceffa70fcad0d14b77a3d3012fcb7ac008a12bd

  • SSDEEP

    24576:rTsNDdDlnAh8b1XX0qIwjERO98EZ7F5jXGYp:rTsNDdZnhyXo5jXL

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\QUOTATION_JUNQTRA031244úPDF.scr
    "C:\Users\Admin\AppData\Local\Temp\QUOTATION_JUNQTRA031244úPDF.scr" /S
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4992
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4124 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3256

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/652-0-0x0000000074F3E000-0x0000000074F3F000-memory.dmp

      Filesize

      4KB

    • memory/652-1-0x0000000000010000-0x000000000021C000-memory.dmp

      Filesize

      2.0MB

    • memory/652-2-0x0000000074F30000-0x00000000756E0000-memory.dmp

      Filesize

      7.7MB

    • memory/652-3-0x00000000070E0000-0x0000000007312000-memory.dmp

      Filesize

      2.2MB

    • memory/652-4-0x00000000078C0000-0x0000000007E64000-memory.dmp

      Filesize

      5.6MB

    • memory/652-5-0x00000000074B0000-0x0000000007542000-memory.dmp

      Filesize

      584KB

    • memory/652-6-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-17-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-33-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-47-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-62-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-69-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-67-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-65-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-63-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-59-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-57-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-55-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-53-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-51-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-49-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-45-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-43-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-41-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-39-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-37-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-35-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-31-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-29-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-27-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-25-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-23-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-21-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-15-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-13-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-11-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-9-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-7-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-19-0x00000000070E0000-0x000000000730C000-memory.dmp

      Filesize

      2.2MB

    • memory/652-2704-0x0000000074F3E000-0x0000000074F3F000-memory.dmp

      Filesize

      4KB

    • memory/652-4893-0x0000000074F30000-0x00000000756E0000-memory.dmp

      Filesize

      7.7MB

    • memory/652-4894-0x00000000009A0000-0x0000000000A0C000-memory.dmp

      Filesize

      432KB

    • memory/652-4895-0x0000000000760000-0x00000000007AC000-memory.dmp

      Filesize

      304KB

    • memory/652-4896-0x0000000000AC0000-0x0000000000B26000-memory.dmp

      Filesize

      408KB

    • memory/652-4897-0x0000000074F30000-0x00000000756E0000-memory.dmp

      Filesize

      7.7MB

    • memory/652-4898-0x0000000000B30000-0x0000000000B84000-memory.dmp

      Filesize

      336KB

    • memory/652-4903-0x0000000074F30000-0x00000000756E0000-memory.dmp

      Filesize

      7.7MB

    • memory/4992-4901-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/4992-4902-0x0000000074F30000-0x00000000756E0000-memory.dmp

      Filesize

      7.7MB

    • memory/4992-4904-0x0000000074F30000-0x00000000756E0000-memory.dmp

      Filesize

      7.7MB

    • memory/4992-4905-0x00000000067C0000-0x0000000006810000-memory.dmp

      Filesize

      320KB

    • memory/4992-4906-0x0000000006820000-0x000000000682A000-memory.dmp

      Filesize

      40KB