Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
03-08-2024 01:15
Behavioral task
behavioral1
Sample
3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe
Resource
win10v2004-20240802-en
General
-
Target
3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe
-
Size
355KB
-
MD5
1dffa9d5b1d33095977375b1aecf4f2b
-
SHA1
1e9172d8822d3477393db4f8c35aa0733eab7bf9
-
SHA256
3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849
-
SHA512
66d0ccd7bca497a649fefaab0b5d5675eee49d546644334f5e41cda12705a7e65b6ef52cb449dcc7f95e85a3f6bd5926acb9df4d648b28d9a4e45f3b6bfdd710
-
SSDEEP
6144:CbeI1OYuG0Lahya/QYMAsYL8wgs3tgbp9PkBqQ0IqQ5FgL:XeUeQYMAsYL8wgs9QpkqpIqQ
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot7390139954:AAFw-89dzufZnN9iQ-qMJ7xuGsXRrzvXAEI/
Extracted
redline
Newlogs
204.14.75.2:16383
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/328-1-0x0000000000250000-0x00000000002AE000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\gqsGEtYIxg\file.exe family_redline behavioral1/memory/2288-16-0x0000000000BC0000-0x0000000000BDE000-memory.dmp family_redline -
SectopRAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/328-1-0x0000000000250000-0x00000000002AE000-memory.dmp family_sectoprat C:\Users\Admin\AppData\Local\Temp\gqsGEtYIxg\file.exe family_sectoprat behavioral1/memory/2288-16-0x0000000000BC0000-0x0000000000BDE000-memory.dmp family_sectoprat -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3012 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
file.exefile.exepid process 2288 file.exe 2820 file.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
file.exefile.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2912 timeout.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exefile.exepid process 328 3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe 2820 file.exe 2820 file.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
Processes:
3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exeWMIC.exefile.exedescription pid process Token: SeDebugPrivilege 328 3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe Token: SeIncreaseQuotaPrivilege 2116 WMIC.exe Token: SeSecurityPrivilege 2116 WMIC.exe Token: SeTakeOwnershipPrivilege 2116 WMIC.exe Token: SeLoadDriverPrivilege 2116 WMIC.exe Token: SeSystemProfilePrivilege 2116 WMIC.exe Token: SeSystemtimePrivilege 2116 WMIC.exe Token: SeProfSingleProcessPrivilege 2116 WMIC.exe Token: SeIncBasePriorityPrivilege 2116 WMIC.exe Token: SeCreatePagefilePrivilege 2116 WMIC.exe Token: SeBackupPrivilege 2116 WMIC.exe Token: SeRestorePrivilege 2116 WMIC.exe Token: SeShutdownPrivilege 2116 WMIC.exe Token: SeDebugPrivilege 2116 WMIC.exe Token: SeSystemEnvironmentPrivilege 2116 WMIC.exe Token: SeRemoteShutdownPrivilege 2116 WMIC.exe Token: SeUndockPrivilege 2116 WMIC.exe Token: SeManageVolumePrivilege 2116 WMIC.exe Token: 33 2116 WMIC.exe Token: 34 2116 WMIC.exe Token: 35 2116 WMIC.exe Token: SeIncreaseQuotaPrivilege 2116 WMIC.exe Token: SeSecurityPrivilege 2116 WMIC.exe Token: SeTakeOwnershipPrivilege 2116 WMIC.exe Token: SeLoadDriverPrivilege 2116 WMIC.exe Token: SeSystemProfilePrivilege 2116 WMIC.exe Token: SeSystemtimePrivilege 2116 WMIC.exe Token: SeProfSingleProcessPrivilege 2116 WMIC.exe Token: SeIncBasePriorityPrivilege 2116 WMIC.exe Token: SeCreatePagefilePrivilege 2116 WMIC.exe Token: SeBackupPrivilege 2116 WMIC.exe Token: SeRestorePrivilege 2116 WMIC.exe Token: SeShutdownPrivilege 2116 WMIC.exe Token: SeDebugPrivilege 2116 WMIC.exe Token: SeSystemEnvironmentPrivilege 2116 WMIC.exe Token: SeRemoteShutdownPrivilege 2116 WMIC.exe Token: SeUndockPrivilege 2116 WMIC.exe Token: SeManageVolumePrivilege 2116 WMIC.exe Token: 33 2116 WMIC.exe Token: 34 2116 WMIC.exe Token: 35 2116 WMIC.exe Token: SeDebugPrivilege 2820 file.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
file.exepid process 2820 file.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.execmd.execmd.exedescription pid process target process PID 328 wrote to memory of 2136 328 3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe cmd.exe PID 328 wrote to memory of 2136 328 3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe cmd.exe PID 328 wrote to memory of 2136 328 3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe cmd.exe PID 2136 wrote to memory of 2116 2136 cmd.exe WMIC.exe PID 2136 wrote to memory of 2116 2136 cmd.exe WMIC.exe PID 2136 wrote to memory of 2116 2136 cmd.exe WMIC.exe PID 328 wrote to memory of 2288 328 3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe file.exe PID 328 wrote to memory of 2288 328 3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe file.exe PID 328 wrote to memory of 2288 328 3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe file.exe PID 328 wrote to memory of 2288 328 3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe file.exe PID 328 wrote to memory of 2820 328 3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe file.exe PID 328 wrote to memory of 2820 328 3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe file.exe PID 328 wrote to memory of 2820 328 3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe file.exe PID 328 wrote to memory of 2820 328 3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe file.exe PID 328 wrote to memory of 3012 328 3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe cmd.exe PID 328 wrote to memory of 3012 328 3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe cmd.exe PID 328 wrote to memory of 3012 328 3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe cmd.exe PID 3012 wrote to memory of 2912 3012 cmd.exe timeout.exe PID 3012 wrote to memory of 2912 3012 cmd.exe timeout.exe PID 3012 wrote to memory of 2912 3012 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe"C:\Users\Admin\AppData\Local\Temp\3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /C wmic path win32_ComputerSystem get model2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_ComputerSystem get model3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\gqsGEtYIxg\file.exe"C:\Users\Admin\AppData\Local\Temp\gqsGEtYIxg\file.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\zvHDaXzkPrdE\file.exe"C:\Users\Admin\AppData\Local\Temp\zvHDaXzkPrdE\file.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C TIMEOUT /T 3 && DEL /f "C:\Users\Admin\AppData\Local\Temp\3bcc155f5bc7b6b5f5a4df83363b57e52ce7e8b88c2ed695023b057874b12849.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exeTIMEOUT /T 33⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\gqsGEtYIxg\file.exeFilesize
95KB
MD5cfa3c4d3b63a5db265a3fdfea72f5dd5
SHA119da030053b3e32907fbf7cdc6641cfadbc9d1d7
SHA25614266cc49018302498bbf452ae1311b3f86bb8544b8601227c90339d337f657f
SHA512b57cf96df30583d6e2d4d091c4417323d6d70fa713e661f8ebaae2f127b25de71af652ed20a820b7c4906844cb5abd9a389dbc8a2d58d5e91860b1eb676c9657
-
C:\Users\Admin\AppData\Local\Temp\zvHDaXzkPrdE\file.exeFilesize
247KB
MD5e559e786f9fe168805fa606256d7e238
SHA11c650a57a2e2406d68b7e1c69aa091474c0e99df
SHA25648bbbcfc4feb7b340f79fad4216adf7ac6b799a16f9c663784e0100ab44f8632
SHA5120e968871776fc010d8a869634f984d58681cd5a6b1815a5f812829a86c55711fe66004c51f4155818f9c3f73a8d01cfd7d2b747a27432d70ae7f6f5a107abbab
-
memory/328-0-0x000007FEF5E13000-0x000007FEF5E14000-memory.dmpFilesize
4KB
-
memory/328-1-0x0000000000250000-0x00000000002AE000-memory.dmpFilesize
376KB
-
memory/2288-16-0x0000000000BC0000-0x0000000000BDE000-memory.dmpFilesize
120KB
-
memory/2820-17-0x00000000002B0000-0x00000000002F4000-memory.dmpFilesize
272KB