Analysis

  • max time kernel
    119s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    31/10/2024, 09:48

General

  • Target

    29.10.2024-29.10.2024.exe

  • Size

    709KB

  • MD5

    9164f558b98c859744b070442f4d4f01

  • SHA1

    63b26d055e7b62b8c87668421a36c6af30ebea1f

  • SHA256

    03207279845f2d90be8cd6b3b525c4a236838c52def79c0afffbdf7216a03b7c

  • SHA512

    9abc886380f1a7f9f5ba10db1da44b5a8e8d5f870d26f9b45ad699f5dd3c7e9d36ad658d12e8645b523228bc0b30ca6504e4982ec55f9341dc3a88bdb3aeb350

  • SSDEEP

    12288:sNaDPw1Qk89Tmy4azzNLYjzOPmgY2N2Kde0pIVC7e748Ylu/7RBoyQdWvsBptkkR:sULw9gTF4aNLBK20Kd/Moe748Yk/9KyK

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Agenttesla family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29.10.2024-29.10.2024.exe
    "C:\Users\Admin\AppData\Local\Temp\29.10.2024-29.10.2024.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1868
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\29.10.2024-29.10.2024.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2604
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IBJvYKNGHz.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2512
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IBJvYKNGHz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1140.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2652
    • C:\Users\Admin\AppData\Local\Temp\29.10.2024-29.10.2024.exe
      "C:\Users\Admin\AppData\Local\Temp\29.10.2024-29.10.2024.exe"
      2⤵
        PID:1828
      • C:\Users\Admin\AppData\Local\Temp\29.10.2024-29.10.2024.exe
        "C:\Users\Admin\AppData\Local\Temp\29.10.2024-29.10.2024.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2324

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\tmp1140.tmp

            Filesize

            1KB

            MD5

            738d44676e0912e078ac8e76de9861e5

            SHA1

            62516350a736ac3c9cd39b883614bdb1ac9b0d5e

            SHA256

            b5e2996f020f6663cd812ca7e8583237190336bf44171f089a670e94b5676d12

            SHA512

            a551e5039892a641f1e39564b5d6c8615171173cdf64c7213f0df87f170e5ac661066e6f66db33523c0d50cf2acac1a801da3c871fa45eb1854cbba2eeba97f6

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

            Filesize

            7KB

            MD5

            572b04372afdec7f4cc79be90c988a62

            SHA1

            9b8f807e5d1d40b5aec4baca287459702a65cf22

            SHA256

            dd3d2fb790cb82aa7eaba4d0ba492861022c3a40984e1ad0a483b2f53b3306e0

            SHA512

            0f27f932c201cd64b491303850c944d0d8cedd63f325febcf479399b2e9157c926110da0d4d07e713dc5940ecacef7b2517129c5202ad7e2b57a8b7ec4ff9518

          • memory/1868-4-0x00000000742EE000-0x00000000742EF000-memory.dmp

            Filesize

            4KB

          • memory/1868-31-0x00000000742E0000-0x00000000749CE000-memory.dmp

            Filesize

            6.9MB

          • memory/1868-0-0x00000000742EE000-0x00000000742EF000-memory.dmp

            Filesize

            4KB

          • memory/1868-5-0x00000000742E0000-0x00000000749CE000-memory.dmp

            Filesize

            6.9MB

          • memory/1868-6-0x0000000000290000-0x0000000000314000-memory.dmp

            Filesize

            528KB

          • memory/1868-2-0x00000000742E0000-0x00000000749CE000-memory.dmp

            Filesize

            6.9MB

          • memory/1868-1-0x00000000000A0000-0x0000000000154000-memory.dmp

            Filesize

            720KB

          • memory/1868-3-0x0000000000580000-0x000000000059E000-memory.dmp

            Filesize

            120KB

          • memory/2324-19-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/2324-23-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/2324-30-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/2324-29-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/2324-28-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/2324-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/2324-21-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/2324-25-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB