Analysis
- max time kernel
105s - max time network
108s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
01/10/2024, 13:15
General
- Target grace.exe
- Size 1.1MB
- Sample241001-qg8dnavfmb
- SHA256 5fc47ca65df767fcb09cc074dff3d5d02ab6c61ffff00b409ea2fa4107e080ce
Malware Config
Extracted
-
Protocol
smtp
-
Host
techniqueqatar.com
-
Port
587
-
Username
-
Password
TechFB2023$$$
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
techniqueqatar.com
-
Port
587
-
Username
-
Password
TechFB2023$$$
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\grace.exe"C:\Users\Admin\AppData\Local\Temp\grace.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\nasal\beeish.exe"C:\Users\Admin\AppData\Local\Temp\grace.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\grace.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
beeish.exe
memory/220-17-0x0000000006420000-0x00000000064B2000-memory.dmp
memory/220-12-0x00000000007C0000-0x0000000000804000-memory.dmp
memory/220-13-0x0000000074FEE000-0x0000000074FEF000-memory.dmp
memory/220-14-0x0000000005360000-0x0000000005904000-memory.dmp
memory/220-15-0x0000000004F70000-0x0000000004FD6000-memory.dmp
memory/220-16-0x0000000074FE0000-0x0000000075790000-memory.dmp
memory/220-20-0x00000000064C0000-0x0000000006510000-memory.dmp
memory/220-21-0x00000000065B0000-0x000000000664C000-memory.dmp
memory/220-22-0x0000000006550000-0x000000000655A000-memory.dmp
memory/220-23-0x0000000074FEE000-0x0000000074FEF000-memory.dmp
memory/220-24-0x0000000074FE0000-0x0000000075790000-memory.dmp
memory/1680-10-0x0000000003F30000-0x0000000004330000-memory.dmp
memory/2388-2-0x00000000044A0000-0x00000000048A0000-memory.dmp