Analysis
- max time kernel
146s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
06/11/2024, 14:04
General
- Target fffad158263ae4e3f5eb206b043d63752ea1cfa2e356c38436a81ffa4aee676c.exe
- Size 957KB
- Sample241106-rc9xcs1flc
- SHA256 fffad158263ae4e3f5eb206b043d63752ea1cfa2e356c38436a81ffa4aee676c
Malware Config
Extracted
-
Protocol
ftp
-
Host
ftp.concaribe.com
-
Port
21
-
Username
-
Password
ro}UWgz#!38E
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.concaribe.com
-
Port
21
-
Username
-
Password
ro}UWgz#!38E
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Loads dropped DLL 2 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fffad158263ae4e3f5eb206b043d63752ea1cfa2e356c38436a81ffa4aee676c.exe"C:\Users\Admin\AppData\Local\Temp\fffad158263ae4e3f5eb206b043d63752ea1cfa2e356c38436a81ffa4aee676c.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fffad158263ae4e3f5eb206b043d63752ea1cfa2e356c38436a81ffa4aee676c.exe"C:\Users\Admin\AppData\Local\Temp\fffad158263ae4e3f5eb206b043d63752ea1cfa2e356c38436a81ffa4aee676c.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
nsbE17A.tmp
nsbE17A.tmp
nsbE17A.tmp
nsbE17A.tmp
nsbE350.tmp
nsbE350.tmp
nsbE350.tmp
nsbE350.tmp
nslE07E.tmp
nslE07E.tmp
System.dll
nslE207.tmp
nslE207.tmp
nslE207.tmp
memory/3604-568-0x0000000077D61000-0x0000000077E81000-memory.dmp
memory/3604-569-0x0000000010004000-0x0000000010005000-memory.dmp
memory/3604-567-0x0000000077D61000-0x0000000077E81000-memory.dmp
memory/4668-576-0x00000000391B0000-0x0000000039754000-memory.dmp
memory/4668-577-0x00000000390E0000-0x0000000039146000-memory.dmp
memory/4668-573-0x0000000077D61000-0x0000000077E81000-memory.dmp
memory/4668-572-0x0000000000480000-0x00000000016D4000-memory.dmp
memory/4668-574-0x0000000072FDE000-0x0000000072FDF000-memory.dmp
memory/4668-575-0x0000000000480000-0x00000000004C2000-memory.dmp
memory/4668-570-0x0000000077DE8000-0x0000000077DE9000-memory.dmp
memory/4668-571-0x0000000077E05000-0x0000000077E06000-memory.dmp
memory/4668-578-0x0000000072FD0000-0x0000000073780000-memory.dmp
memory/4668-580-0x0000000039FC0000-0x000000003A010000-memory.dmp
memory/4668-581-0x000000003A030000-0x000000003A0CC000-memory.dmp
memory/4668-582-0x000000003A150000-0x000000003A1E2000-memory.dmp
memory/4668-583-0x000000003A230000-0x000000003A23A000-memory.dmp
memory/4668-584-0x0000000072FDE000-0x0000000072FDF000-memory.dmp
memory/4668-585-0x0000000072FD0000-0x0000000073780000-memory.dmp