Analysis
- max time kernel
147s - max time network
127s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
19/10/2024, 02:48
General
- Target fff67160a40353338a0eb9ee2acb6cd15de640023ef8a819d6595ef34493757b.exe
- Size 1016KB
- Sample241019-dae3basfrh
- SHA256 fff67160a40353338a0eb9ee2acb6cd15de640023ef8a819d6595ef34493757b
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.concaribe.com
-
Port
21
-
Username
-
Password
ro}UWgz#!38E
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Loads dropped DLL 2 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fff67160a40353338a0eb9ee2acb6cd15de640023ef8a819d6595ef34493757b.exe"C:\Users\Admin\AppData\Local\Temp\fff67160a40353338a0eb9ee2acb6cd15de640023ef8a819d6595ef34493757b.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fff67160a40353338a0eb9ee2acb6cd15de640023ef8a819d6595ef34493757b.exe"C:\Users\Admin\AppData\Local\Temp\fff67160a40353338a0eb9ee2acb6cd15de640023ef8a819d6595ef34493757b.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
nsjB81C.tmp
nsjB81C.tmp
nsoB74F.tmp
nsoB8D9.tmp
nstB85B.tmp
nstB85B.tmp
nstB85B.tmp
nstB85B.tmp
nstB85B.tmp
nsyBA50.tmp
barleybird.ini
System.dll
memory/2012-845-0x0000000003AA0000-0x0000000006382000-memory.dmp
memory/2012-847-0x0000000077590000-0x0000000077739000-memory.dmp
memory/2012-846-0x0000000077591000-0x0000000077692000-memory.dmp
memory/2012-848-0x0000000003AA0000-0x0000000006382000-memory.dmp
memory/3060-849-0x0000000077590000-0x0000000077739000-memory.dmp
memory/3060-850-0x0000000000820000-0x0000000001882000-memory.dmp
memory/3060-851-0x0000000000820000-0x0000000001882000-memory.dmp
memory/3060-852-0x0000000000820000-0x0000000000862000-memory.dmp