Analysis
- max time kernel
97s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
27/09/2024, 14:00
General
- Target Richardson Electronics, LTD. PRD10221301UUE.exe
- Size 6KB
- Sample240927-razzdayblb
- SHA256 3b799063aa6a0a79e4a160b4650dc3199ebe128d1a183de4591e03a0b29674f1
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.alternatifplastik.com
-
Port
21
-
Username
-
Password
Fineboy777@
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\Richardson Electronics, LTD. PRD10221301UUE.exe"C:\Users\Admin\AppData\Local\Temp\Richardson Electronics, LTD. PRD10221301UUE.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3840-0-0x00000000745DE000-0x00000000745DF000-memory.dmp
memory/3840-1-0x0000000000020000-0x0000000000028000-memory.dmp
memory/3840-2-0x00000000745D0000-0x0000000074D80000-memory.dmp
memory/3840-3-0x00000000054B0000-0x00000000055A0000-memory.dmp
memory/3840-11-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-19-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-65-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-63-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-61-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-60-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-55-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-53-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-51-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-49-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-47-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-43-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-41-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-39-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-37-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-35-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-31-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-30-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-23-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-21-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-17-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-15-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-13-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-67-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-57-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-45-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-33-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-27-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-25-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-9-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-7-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-5-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-4-0x00000000054B0000-0x000000000559A000-memory.dmp
memory/3840-1078-0x00000000745D0000-0x0000000074D80000-memory.dmp
memory/3840-1079-0x00000000057F0000-0x000000000585A000-memory.dmp
memory/3840-1080-0x0000000005860000-0x00000000058AC000-memory.dmp
memory/3840-1084-0x00000000745D0000-0x0000000074D80000-memory.dmp
memory/3840-1085-0x00000000745D0000-0x0000000074D80000-memory.dmp
memory/3840-1086-0x00000000745D0000-0x0000000074D80000-memory.dmp
memory/3840-1087-0x0000000006020000-0x00000000065C4000-memory.dmp
memory/3840-1088-0x00000000058F0000-0x0000000005944000-memory.dmp
memory/3840-1092-0x00000000745D0000-0x0000000074D80000-memory.dmp
memory/4612-1091-0x00000000745D0000-0x0000000074D80000-memory.dmp
memory/4612-1093-0x0000000000710000-0x0000000000750000-memory.dmp
memory/4612-1094-0x00000000745D0000-0x0000000074D80000-memory.dmp
memory/4612-1095-0x0000000004D60000-0x0000000004DC6000-memory.dmp
memory/4612-1096-0x0000000005C50000-0x0000000005CA0000-memory.dmp
memory/4612-1097-0x0000000005D40000-0x0000000005DD2000-memory.dmp
memory/4612-1098-0x0000000005CD0000-0x0000000005CDA000-memory.dmp
memory/4612-1099-0x00000000745D0000-0x0000000074D80000-memory.dmp