Analysis

  • max time kernel
    94s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-09-2024 10:27

General

  • Target

    Trojan.Win32.exe

  • Size

    1.1MB

  • MD5

    a4ce1e254f94ddadcdc22828387203b0

  • SHA1

    2ec0421afe6315ab24aa9c4219d5ee602798297b

  • SHA256

    fae3c02edbdbe902b73f28b56b12f62041fc0fc360c42f970cdff0d91310bb32

  • SHA512

    20c044a0332cfda930d43552681602a47b8a27ba977415bf434cb1a85b29a8f7347d9c80d69aa4a72c09a9746f7ab241c7d52add9b513700c8f18b815a3de4a9

  • SSDEEP

    24576:s4lavt0LkLL9IMixoEgeahX2aCKPoiPNR5Mq9MmCS:7kwkn9IMHeahX2axtN4aPCS

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3260
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 816
      2⤵
      • Program crash
      PID:4532
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2708 -ip 2708
    1⤵
      PID:2712

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2708-6-0x00000000018C0000-0x0000000001CC0000-memory.dmp

      Filesize

      4.0MB

    • memory/3260-7-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/3260-8-0x000000007448E000-0x000000007448F000-memory.dmp

      Filesize

      4KB

    • memory/3260-9-0x00000000054D0000-0x0000000005A74000-memory.dmp

      Filesize

      5.6MB

    • memory/3260-10-0x0000000005020000-0x0000000005086000-memory.dmp

      Filesize

      408KB

    • memory/3260-11-0x0000000074480000-0x0000000074C30000-memory.dmp

      Filesize

      7.7MB

    • memory/3260-12-0x0000000005E90000-0x0000000005EE0000-memory.dmp

      Filesize

      320KB

    • memory/3260-13-0x0000000005F80000-0x0000000006012000-memory.dmp

      Filesize

      584KB

    • memory/3260-14-0x0000000005F20000-0x0000000005F2A000-memory.dmp

      Filesize

      40KB

    • memory/3260-15-0x000000007448E000-0x000000007448F000-memory.dmp

      Filesize

      4KB

    • memory/3260-16-0x0000000074480000-0x0000000074C30000-memory.dmp

      Filesize

      7.7MB