Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18-09-2024 12:20

General

  • Target

    file.exe

  • Size

    239KB

  • MD5

    e89f78e780b64eeb920d5dfebd033ffa

  • SHA1

    b964dc9e8f5350d3a917b6a26b58853099859d8b

  • SHA256

    d48ee1f6f04504d641c8769aeef83185c8de8745458a3fbc362cd53c20ef10d9

  • SHA512

    ee38ff8ed0c955616bd7ef3ab4112765407490a2bf93523a66ba8924b8674febe73d90c95406acd0fc793904f8cb641f300f8c0a4ee48345f094ce02a91e4fa0

  • SSDEEP

    3072:JxN3NB1x9xCxSW2MqnNLZ7UtbvDK59uW58UGQ:tNB1x9xCxSW2MqNLZ7YbvDi35l

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.antoniomayol.com:21
  • Port:
    21
  • Username:
    johnson@antoniomayol.com
  • Password:
    cMhKDQUk1{;%

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1744

Network

  • flag-us
    DNS
    ip-api.com
    file.exe
    Remote address:
    8.8.8.8:53
    Request
    ip-api.com
    IN A
    Response
    ip-api.com
    IN A
    208.95.112.1
  • flag-us
    GET
    http://ip-api.com/line/?fields=hosting
    file.exe
    Remote address:
    208.95.112.1:80
    Request
    GET /line/?fields=hosting HTTP/1.1
    Host: ip-api.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Wed, 18 Sep 2024 12:20:16 GMT
    Content-Type: text/plain; charset=utf-8
    Content-Length: 6
    Access-Control-Allow-Origin: *
    X-Ttl: 60
    X-Rl: 44
  • 208.95.112.1:80
    http://ip-api.com/line/?fields=hosting
    http
    file.exe
    310 B
    347 B
    5
    4

    HTTP Request

    GET http://ip-api.com/line/?fields=hosting

    HTTP Response

    200
  • 8.8.8.8:53
    ip-api.com
    dns
    file.exe
    56 B
    72 B
    1
    1

    DNS Request

    ip-api.com

    DNS Response

    208.95.112.1

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1744-0-0x000000007497E000-0x000000007497F000-memory.dmp

    Filesize

    4KB

  • memory/1744-1-0x0000000000CA0000-0x0000000000CE2000-memory.dmp

    Filesize

    264KB

  • memory/1744-2-0x0000000074970000-0x000000007505E000-memory.dmp

    Filesize

    6.9MB

  • memory/1744-3-0x000000007497E000-0x000000007497F000-memory.dmp

    Filesize

    4KB

  • memory/1744-4-0x0000000074970000-0x000000007505E000-memory.dmp

    Filesize

    6.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.