Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
23/07/2024, 05:41
General
- Target Order SMG 201906 20190816orderGMD#0498366Deta.exe
- Size 2.3MB
- Sample240723-gdfd2azfjf
- SHA256 a6dd827620007d29efb0f45a61ef6d7e1e6957d56103e8c61d6562cda8ef9c78
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
s82.gocheapweb.com
-
Port
587
-
Username
-
Password
london@1759
-
Email to
Extracted
-
redline
-
FOZ
-
206.217.128.11:1912
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order SMG 201906 20190816orderGMD#0498366Deta.exe"C:\Users\Admin\AppData\Local\Temp\Order SMG 201906 20190816orderGMD#0498366Deta.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\neworigin.exe"C:\Users\Admin\AppData\Local\Temp\neworigin.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
build.exe
neworigin.exe
memory/1504-40-0x0000000005990000-0x00000000059DC000-memory.dmp
memory/1504-35-0x00000000056E0000-0x00000000056EA000-memory.dmp
memory/1504-44-0x0000000008210000-0x000000000873C000-memory.dmp
memory/1504-43-0x0000000007390000-0x0000000007552000-memory.dmp
memory/1504-39-0x0000000005810000-0x000000000584C000-memory.dmp
memory/1504-30-0x0000000000C00000-0x0000000000C52000-memory.dmp
memory/1504-33-0x0000000005550000-0x00000000055E2000-memory.dmp
memory/1504-37-0x0000000005880000-0x000000000598A000-memory.dmp
memory/1504-38-0x00000000057B0000-0x00000000057C2000-memory.dmp
memory/1504-36-0x0000000006630000-0x0000000006C48000-memory.dmp
memory/2124-4-0x00000000744F0000-0x0000000074CA0000-memory.dmp
memory/2124-31-0x00000000744F0000-0x0000000074CA0000-memory.dmp
memory/2124-2-0x00000000744FE000-0x00000000744FF000-memory.dmp
memory/2124-1-0x0000000000400000-0x0000000000490000-memory.dmp
memory/3908-34-0x0000000005940000-0x00000000059A6000-memory.dmp
memory/3908-32-0x00000000744F0000-0x0000000074CA0000-memory.dmp
memory/3908-29-0x0000000005EF0000-0x0000000006494000-memory.dmp
memory/3908-41-0x00000000070C0000-0x0000000007110000-memory.dmp
memory/3908-42-0x00000000071B0000-0x000000000724C000-memory.dmp
memory/3908-23-0x00000000744F0000-0x0000000074CA0000-memory.dmp
memory/3908-24-0x0000000000ED0000-0x0000000000F14000-memory.dmp
memory/3908-46-0x00000000744F0000-0x0000000074CA0000-memory.dmp