Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    19-09-2024 01:49

General

  • Target

    da049cf547f66a701590bd333a9d61d0f7c448e3b798018f3d50497cc94445c7.exe

  • Size

    1.3MB

  • MD5

    a8371130da53aa606d8c72201192ee47

  • SHA1

    3190b84eae50e45b78de3fa23b0de2541d73ea0b

  • SHA256

    da049cf547f66a701590bd333a9d61d0f7c448e3b798018f3d50497cc94445c7

  • SHA512

    0d849384b92eb807cfdcb1834d72b1506a5b73bd2c3fae09e291a71b0b0572737e1a2ceae0704b7ed89b3fdec386a516c5a1e907682e24caf0dc0c356ab44acb

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaCzpQOAjXcup8W6xRnhI7Eoc7ehSc/cP:7JZoQrbTFZY1iaCzeOGsW89P/oNSz

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da049cf547f66a701590bd333a9d61d0f7c448e3b798018f3d50497cc94445c7.exe
    "C:\Users\Admin\AppData\Local\Temp\da049cf547f66a701590bd333a9d61d0f7c448e3b798018f3d50497cc94445c7.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2984
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\da049cf547f66a701590bd333a9d61d0f7c448e3b798018f3d50497cc94445c7.exe"
      2⤵
        PID:2428
      • C:\Users\Admin\AppData\Local\Temp\da049cf547f66a701590bd333a9d61d0f7c448e3b798018f3d50497cc94445c7.exe
        "C:\Users\Admin\AppData\Local\Temp\da049cf547f66a701590bd333a9d61d0f7c448e3b798018f3d50497cc94445c7.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2104
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Users\Admin\AppData\Local\Temp\da049cf547f66a701590bd333a9d61d0f7c448e3b798018f3d50497cc94445c7.exe"
          3⤵
            PID:3020
          • C:\Users\Admin\AppData\Local\Temp\da049cf547f66a701590bd333a9d61d0f7c448e3b798018f3d50497cc94445c7.exe
            "C:\Users\Admin\AppData\Local\Temp\da049cf547f66a701590bd333a9d61d0f7c448e3b798018f3d50497cc94445c7.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2860
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
              "C:\Users\Admin\AppData\Local\Temp\da049cf547f66a701590bd333a9d61d0f7c448e3b798018f3d50497cc94445c7.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3052

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\reaffection

        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • memory/2104-6-0x0000000003E20000-0x0000000004220000-memory.dmp

        Filesize

        4.0MB

      • memory/2860-10-0x0000000003DE0000-0x00000000041E0000-memory.dmp

        Filesize

        4.0MB

      • memory/2984-2-0x0000000003630000-0x0000000003A30000-memory.dmp

        Filesize

        4.0MB

      • memory/3052-64-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-1054-0x00000000742F0000-0x00000000749DE000-memory.dmp

        Filesize

        6.9MB

      • memory/3052-14-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

      • memory/3052-60-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-16-0x0000000001D70000-0x0000000001DC4000-memory.dmp

        Filesize

        336KB

      • memory/3052-17-0x00000000742F0000-0x00000000749DE000-memory.dmp

        Filesize

        6.9MB

      • memory/3052-18-0x00000000742F0000-0x00000000749DE000-memory.dmp

        Filesize

        6.9MB

      • memory/3052-20-0x00000000742F0000-0x00000000749DE000-memory.dmp

        Filesize

        6.9MB

      • memory/3052-19-0x0000000001E70000-0x0000000001EC2000-memory.dmp

        Filesize

        328KB

      • memory/3052-34-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-30-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-21-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-52-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-80-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-78-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-76-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-74-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-56-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-68-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-66-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-11-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

      • memory/3052-62-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-15-0x00000000742FE000-0x00000000742FF000-memory.dmp

        Filesize

        4KB

      • memory/3052-13-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

      • memory/3052-72-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-50-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-48-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-46-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-45-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-42-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-40-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-38-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-36-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-32-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-28-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-26-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-24-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-70-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-22-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-54-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-1051-0x00000000742F0000-0x00000000749DE000-memory.dmp

        Filesize

        6.9MB

      • memory/3052-1052-0x0000000000400000-0x0000000000446000-memory.dmp

        Filesize

        280KB

      • memory/3052-1053-0x00000000742FE000-0x00000000742FF000-memory.dmp

        Filesize

        4KB

      • memory/3052-58-0x0000000001E70000-0x0000000001EBD000-memory.dmp

        Filesize

        308KB

      • memory/3052-1055-0x00000000742F0000-0x00000000749DE000-memory.dmp

        Filesize

        6.9MB