Analysis

  • max time kernel
    143s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-09-2024 22:32

General

  • Target

    32dd3fff0f61aab860e6f50e2ad3b8ca.exe

  • Size

    769KB

  • MD5

    32dd3fff0f61aab860e6f50e2ad3b8ca

  • SHA1

    01b99169e4cb5bfb2282a7b766725f9d6e472c92

  • SHA256

    700f3ac0cc9b1a26ba213ebcf344af38972795efbbf01a56b3b0190790838c8a

  • SHA512

    fedaa7a8c93c96723a5dfb896cbf0ee70c082fa23cd22b7cbcbdfb342d99bb31c50073ebdebe7adeaf2cc38946d8267d884b8f16962c96c7605c02006045534e

  • SSDEEP

    12288:30cmlfRrt583KWgr8L5R/dh/ygyn8dcIq8Lr8i6b7L8uKwnRk/xO6MjvLe8:OfRrtudgreth/r8NvzKwnRk/UvLe8

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    bayermlb.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    belnel@123

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 5 IoCs
  • CustAttr .NET packer 1 IoCs

    Detects CustAttr .NET packer in memory.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\32dd3fff0f61aab860e6f50e2ad3b8ca.exe
    "C:\Users\Admin\AppData\Local\Temp\32dd3fff0f61aab860e6f50e2ad3b8ca.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Users\Admin\AppData\Local\Temp\32dd3fff0f61aab860e6f50e2ad3b8ca.exe
      "C:\Users\Admin\AppData\Local\Temp\32dd3fff0f61aab860e6f50e2ad3b8ca.exe"
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2672-0-0x000000007431E000-0x000000007431F000-memory.dmp

    Filesize

    4KB

  • memory/2672-1-0x0000000000170000-0x0000000000236000-memory.dmp

    Filesize

    792KB

  • memory/2672-2-0x0000000074310000-0x00000000749FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2672-3-0x00000000003D0000-0x00000000003DA000-memory.dmp

    Filesize

    40KB

  • memory/2672-4-0x0000000074310000-0x00000000749FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2672-5-0x000000007431E000-0x000000007431F000-memory.dmp

    Filesize

    4KB

  • memory/2672-6-0x0000000074310000-0x00000000749FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2672-7-0x0000000005D40000-0x0000000005DCA000-memory.dmp

    Filesize

    552KB

  • memory/2672-8-0x0000000004650000-0x000000000469E000-memory.dmp

    Filesize

    312KB

  • memory/2672-24-0x0000000074310000-0x00000000749FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2912-21-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2912-19-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2912-17-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2912-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2912-13-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2912-11-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2912-10-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2912-22-0x0000000074310000-0x00000000749FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2912-23-0x0000000074310000-0x00000000749FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2912-9-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2912-25-0x0000000074310000-0x00000000749FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2912-26-0x0000000074310000-0x00000000749FE000-memory.dmp

    Filesize

    6.9MB