Analysis

  • max time kernel
    99s
  • max time network
    192s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-09-2024 05:54

General

  • Target

    oc_202486545346576879879856879876756875246.exe

  • Size

    1.1MB

  • MD5

    ef3b33eda19bdf6cc936b97f7e582f1d

  • SHA1

    2f67db5fb6220c97ade8c9a016e0553af766efe3

  • SHA256

    6d7383506176b2d66904efea5dfee58a70ad683ee01d9bf6a49066a92ab81cf6

  • SHA512

    975c729679891c2552d9f444a6f68f80ca122c6476599efe1b257791695647577c7b003146ef5dd457ead393d5da42b74949a6aadb514d24847d5e4bce1924e3

  • SSDEEP

    24576:0RmJkcoQricOIQxiZY1iaae3Ut4xK9+UfLWYG6uwiQizOVEC0ZL:RJZoQrbTFZY1iaaYQ409XmZwnizOVa

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1749457201:AAGWIY2QPzrHZIumAIUsWjyRAEWcJrauccY/sendDocument

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Drops file in Drivers directory 1 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\oc_202486545346576879879856879876756875246.exe
    "C:\Users\Admin\AppData\Local\Temp\oc_202486545346576879879856879876756875246.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3320
    • C:\Users\Admin\AppData\Local\zero\xapp.exe
      "C:\Users\Admin\AppData\Local\Temp\oc_202486545346576879879856879876756875246.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:388
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Users\Admin\AppData\Local\Temp\oc_202486545346576879879856879876756875246.exe"
        3⤵
        • Drops file in Drivers directory
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • outlook_office_path
        • outlook_win_path
        PID:4312

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ageless

    Filesize

    216KB

    MD5

    144437ffcae3247c92b89924a6a3ef77

    SHA1

    24e01f00e80fdb2180987cec414124a108b4e4b1

    SHA256

    e5182b75dfab0c8cff856f1164cf2b6223d4ba95c50ef1a73b5c7fefb3cc7a5e

    SHA512

    5c9335e6c3b647781dc7fe995552f80b22d4354207a30c9b3fb3c564a190b233e07eaafb44609906859e2c11daba61d6afdcdacdc95ce0adc02d821c5743744d

  • C:\Users\Admin\AppData\Local\zero\xapp.exe

    Filesize

    1.1MB

    MD5

    ef3b33eda19bdf6cc936b97f7e582f1d

    SHA1

    2f67db5fb6220c97ade8c9a016e0553af766efe3

    SHA256

    6d7383506176b2d66904efea5dfee58a70ad683ee01d9bf6a49066a92ab81cf6

    SHA512

    975c729679891c2552d9f444a6f68f80ca122c6476599efe1b257791695647577c7b003146ef5dd457ead393d5da42b74949a6aadb514d24847d5e4bce1924e3

  • memory/388-10-0x0000000004010000-0x0000000004410000-memory.dmp

    Filesize

    4.0MB

  • memory/3320-2-0x0000000004350000-0x0000000004750000-memory.dmp

    Filesize

    4.0MB

  • memory/4312-16-0x0000000004CF0000-0x0000000004D8C000-memory.dmp

    Filesize

    624KB

  • memory/4312-13-0x000000007538E000-0x000000007538F000-memory.dmp

    Filesize

    4KB

  • memory/4312-14-0x0000000005050000-0x00000000055F4000-memory.dmp

    Filesize

    5.6MB

  • memory/4312-15-0x0000000004AA0000-0x0000000004B32000-memory.dmp

    Filesize

    584KB

  • memory/4312-12-0x0000000000410000-0x000000000044C000-memory.dmp

    Filesize

    240KB

  • memory/4312-17-0x0000000075380000-0x0000000075B30000-memory.dmp

    Filesize

    7.7MB

  • memory/4312-18-0x0000000004F90000-0x0000000004FA8000-memory.dmp

    Filesize

    96KB

  • memory/4312-19-0x0000000005A40000-0x0000000005AA6000-memory.dmp

    Filesize

    408KB

  • memory/4312-20-0x000000007538E000-0x000000007538F000-memory.dmp

    Filesize

    4KB

  • memory/4312-21-0x0000000075380000-0x0000000075B30000-memory.dmp

    Filesize

    7.7MB

  • memory/4312-23-0x0000000005C00000-0x0000000005C50000-memory.dmp

    Filesize

    320KB

  • memory/4312-24-0x0000000000AB0000-0x0000000000ABA000-memory.dmp

    Filesize

    40KB