General
-
Target
Quotation.exe
-
Size
1.1MB
-
Sample
241111-mvkb7sybnj
-
MD5
5bdcc2d33ca974c1d8448afcf83f74d1
-
SHA1
f693dea01991d995173a5934d478ad43c50e28e2
-
SHA256
4ad4bb99aa68ac6d5828c71c3f3d5d2983ead0626fd77aba7bb98de727a4b90b
-
SHA512
35633187911d09542892a55671ce6d2953418466185b57aa506fabf039c97a7375c8ad4268f3ded8f9fe5bb7a36a3c688d2321056b7c0aff3546a630df30bbbf
-
SSDEEP
24576:X4nhDoAFnNn+rb27TGQwpoxmBNFt/ZNXLGQ7WczkxFnfbP9:X+hkSNwbwGlym5tBNXKQKczg
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.showpiece.trillennium.biz - Port:
587 - Username:
[email protected] - Password:
3KJ[T.3]fsSW - Email To:
[email protected]
Targets
-
-
Target
Quotation.exe
-
Size
1.1MB
-
MD5
5bdcc2d33ca974c1d8448afcf83f74d1
-
SHA1
f693dea01991d995173a5934d478ad43c50e28e2
-
SHA256
4ad4bb99aa68ac6d5828c71c3f3d5d2983ead0626fd77aba7bb98de727a4b90b
-
SHA512
35633187911d09542892a55671ce6d2953418466185b57aa506fabf039c97a7375c8ad4268f3ded8f9fe5bb7a36a3c688d2321056b7c0aff3546a630df30bbbf
-
SSDEEP
24576:X4nhDoAFnNn+rb27TGQwpoxmBNFt/ZNXLGQ7WczkxFnfbP9:X+hkSNwbwGlym5tBNXKQKczg
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
12KB
-
MD5
d6f54d2cefdf58836805796f55bfc846
-
SHA1
b980addc1a755b968dd5799179d3b4f1c2de9d2d
-
SHA256
f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9
-
SHA512
ce67da936a93d46ef7e81abc8276787c82fd844c03630ba18afc3528c7e420c3228bfe82aeda083bb719f2d1314afae913362abd1e220cb364606519690d45db
-
SSDEEP
192:acA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:RR7SrtTv53tdtTgwF4SQbGPX36wJMw
Score3/10 -
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1