Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    16/12/2024, 13:07 UTC

General

  • Target

    factura 000601.exe

  • Size

    949KB

  • MD5

    daa9839e2d085683d0a9f98bf1a485cf

  • SHA1

    62a0fd15177c5b8123a05be32fd1427e8cf2bbb3

  • SHA256

    e51d2899706d1fc7b2ceb507d49ffd09be932c79e99b0c820eaabe6b39b980c5

  • SHA512

    b2a5e944d367711f44d8c8b2035d30950475631b5e62ad9a4e46910fe50fb23a23f18fa1ab6eee11959b9e801b7ab40a8ae148ac015f01ed0c1a1dfd029b858d

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaCvqoG0Q+98vd5PG:7JZoQrbTFZY1iaCvs05KjPG

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.jeepcommerce.rs
  • Port:
    21
  • Username:
    kel-bin@jeepcommerce.rs
  • Password:
    Jhrn)GcpiYQ7

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Agenttesla family
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\factura 000601.exe
    "C:\Users\Admin\AppData\Local\Temp\factura 000601.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\factura 000601.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2744

Network

  • flag-us
    DNS
    ip-api.com
    RegSvcs.exe
    Remote address:
    8.8.8.8:53
    Request
    ip-api.com
    IN A
    Response
    ip-api.com
    IN A
    208.95.112.1
  • flag-us
    GET
    http://ip-api.com/line/?fields=hosting
    RegSvcs.exe
    Remote address:
    208.95.112.1:80
    Request
    GET /line/?fields=hosting HTTP/1.1
    Host: ip-api.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Mon, 16 Dec 2024 13:07:21 GMT
    Content-Type: text/plain; charset=utf-8
    Content-Length: 6
    Access-Control-Allow-Origin: *
    X-Ttl: 60
    X-Rl: 44
  • 208.95.112.1:80
    http://ip-api.com/line/?fields=hosting
    http
    RegSvcs.exe
    356 B
    347 B
    6
    4

    HTTP Request

    GET http://ip-api.com/line/?fields=hosting

    HTTP Response

    200
  • 8.8.8.8:53
    ip-api.com
    dns
    RegSvcs.exe
    56 B
    72 B
    1
    1

    DNS Request

    ip-api.com

    DNS Response

    208.95.112.1

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Aaberg

    Filesize

    263KB

    MD5

    57edaa8382ff8c9d62264ca23d5cd026

    SHA1

    be4cf11fe9f311b817c1410cc1630b3ef6ef3632

    SHA256

    954f3c73beb262a1481b8be0ff0d847086d60652a2380dcd7bc13280c8c37a62

    SHA512

    6086d99a0da4fe2f17139d1767ebc119c671afeb4f22706294744e5e6eaf2b7f9ef910b7a970e1b9ab12ade5bb22875cd0c290456540e603b16865839a2df287

  • memory/2208-6-0x00000000001D0000-0x00000000001D4000-memory.dmp

    Filesize

    16KB

  • memory/2744-28-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-40-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-70-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-68-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-66-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-64-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-62-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-58-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-56-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-54-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-52-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-50-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-48-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-60-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-44-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-20-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-38-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-34-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-32-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-30-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-78-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-27-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-72-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-24-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-46-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-1085-0x0000000074490000-0x0000000074B7E000-memory.dmp

    Filesize

    6.9MB

  • memory/2744-42-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-36-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-18-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-17-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-22-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-16-0x0000000000360000-0x00000000003B4000-memory.dmp

    Filesize

    336KB

  • memory/2744-15-0x0000000074490000-0x0000000074B7E000-memory.dmp

    Filesize

    6.9MB

  • memory/2744-14-0x0000000074490000-0x0000000074B7E000-memory.dmp

    Filesize

    6.9MB

  • memory/2744-13-0x0000000074490000-0x0000000074B7E000-memory.dmp

    Filesize

    6.9MB

  • memory/2744-12-0x00000000002E0000-0x0000000000336000-memory.dmp

    Filesize

    344KB

  • memory/2744-11-0x000000007449E000-0x000000007449F000-memory.dmp

    Filesize

    4KB

  • memory/2744-10-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2744-9-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2744-7-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2744-74-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-76-0x0000000000360000-0x00000000003AE000-memory.dmp

    Filesize

    312KB

  • memory/2744-1086-0x000000007449E000-0x000000007449F000-memory.dmp

    Filesize

    4KB

  • memory/2744-1087-0x0000000074490000-0x0000000074B7E000-memory.dmp

    Filesize

    6.9MB

  • memory/2744-1088-0x0000000074490000-0x0000000074B7E000-memory.dmp

    Filesize

    6.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.