Resubmissions

11-12-2024 15:32

241211-sy44nssrdm 10

09-08-2024 21:57

240809-1t1vfs1cpm 10

06-08-2024 13:01

240806-p9f97szdlm 10

06-08-2024 12:52

240806-p3672stdkg 10

06-08-2024 12:29

240806-ppa8fsygqr 10

06-08-2024 12:26

240806-pmc92ashlh 10

Analysis

  • max time kernel
    36s
  • max time network
    28s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    06-08-2024 13:01

General

  • Target

    1/3bfcb4f798ba63a1d18887cb67c90e083d5561a58136a892bd9944528c707671.exe

  • Size

    731KB

  • MD5

    bd1050f3642d22733a30cd101f591713

  • SHA1

    5a6553bea21e2df2307ed5c843072bcb023566be

  • SHA256

    3bfcb4f798ba63a1d18887cb67c90e083d5561a58136a892bd9944528c707671

  • SHA512

    6cc19b1df105d9f4e76c39f7be79c9a5a42fdb338a8b56b1d16e1343221e36552344fc30aa8c2bf4d48781694a412dcddb5858a36c643706bc778b0b8cc59883

  • SSDEEP

    12288:tmoDWx2PQfRcudR5C3T+Lc7vaVs95ucinaj13Tp8K2:tHawMR9/gDR5yrQx2K2

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.libreriagandhi.cl
  • Port:
    21
  • Username:
    zativax1@libreriagandhi.cl
  • Password:
    x6p2^m#1#~+O

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1\3bfcb4f798ba63a1d18887cb67c90e083d5561a58136a892bd9944528c707671.exe
    "C:\Users\Admin\AppData\Local\Temp\1\3bfcb4f798ba63a1d18887cb67c90e083d5561a58136a892bd9944528c707671.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:760
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1\3bfcb4f798ba63a1d18887cb67c90e083d5561a58136a892bd9944528c707671.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2216
    • C:\Users\Admin\AppData\Local\Temp\1\3bfcb4f798ba63a1d18887cb67c90e083d5561a58136a892bd9944528c707671.exe
      "C:\Users\Admin\AppData\Local\Temp\1\3bfcb4f798ba63a1d18887cb67c90e083d5561a58136a892bd9944528c707671.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2640

Network

  • flag-us
    DNS
    ip-api.com
    3bfcb4f798ba63a1d18887cb67c90e083d5561a58136a892bd9944528c707671.exe
    Remote address:
    8.8.8.8:53
    Request
    ip-api.com
    IN A
    Response
    ip-api.com
    IN A
    208.95.112.1
  • flag-us
    GET
    http://ip-api.com/line/?fields=hosting
    3bfcb4f798ba63a1d18887cb67c90e083d5561a58136a892bd9944528c707671.exe
    Remote address:
    208.95.112.1:80
    Request
    GET /line/?fields=hosting HTTP/1.1
    Host: ip-api.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Tue, 06 Aug 2024 13:03:00 GMT
    Content-Type: text/plain; charset=utf-8
    Content-Length: 6
    Access-Control-Allow-Origin: *
    X-Ttl: 51
    X-Rl: 43
  • 208.95.112.1:80
    http://ip-api.com/line/?fields=hosting
    http
    3bfcb4f798ba63a1d18887cb67c90e083d5561a58136a892bd9944528c707671.exe
    264 B
    267 B
    4
    2

    HTTP Request

    GET http://ip-api.com/line/?fields=hosting

    HTTP Response

    200
  • 8.8.8.8:53
    ip-api.com
    dns
    3bfcb4f798ba63a1d18887cb67c90e083d5561a58136a892bd9944528c707671.exe
    56 B
    72 B
    1
    1

    DNS Request

    ip-api.com

    DNS Response

    208.95.112.1

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/760-0-0x000000007486E000-0x000000007486F000-memory.dmp

    Filesize

    4KB

  • memory/760-1-0x0000000001270000-0x000000000132C000-memory.dmp

    Filesize

    752KB

  • memory/760-2-0x0000000074860000-0x0000000074F4E000-memory.dmp

    Filesize

    6.9MB

  • memory/760-3-0x0000000000740000-0x000000000075A000-memory.dmp

    Filesize

    104KB

  • memory/760-4-0x0000000000800000-0x000000000080E000-memory.dmp

    Filesize

    56KB

  • memory/760-5-0x00000000010A0000-0x0000000001124000-memory.dmp

    Filesize

    528KB

  • memory/760-21-0x0000000074860000-0x0000000074F4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2640-19-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2640-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2640-11-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2640-20-0x0000000074860000-0x0000000074F4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2640-10-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2640-17-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2640-15-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2640-6-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2640-8-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2640-22-0x0000000074860000-0x0000000074F4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2640-25-0x0000000074860000-0x0000000074F4E000-memory.dmp

    Filesize

    6.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.