Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-12-2024 01:05

General

  • Target

    3f53aed02e3a0f3f353d1f644c769c768e9ea9ce3dbeeb708e8af3ee98b4b534.exe

  • Size

    553KB

  • MD5

    9696450d184ac26fbebff14339311e0e

  • SHA1

    7f39f6b5ba8f9874242b4d821bd13c1b8d45544c

  • SHA256

    3f53aed02e3a0f3f353d1f644c769c768e9ea9ce3dbeeb708e8af3ee98b4b534

  • SHA512

    9d3801148e2c938e0cf90de06aca6493d34b377b143e6941daac77955b4e48cc88be254058a93029aef31771f2be30942750fb93f397d84c7f23c790ae64adce

  • SSDEEP

    6144:CpY5xwJSajAqUCkOCqxxx4NJn/omgtqBtLX6WkSM:JcSa4Bqt4NJ/omgcHX6VP

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Agenttesla family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3440
      • C:\Users\Admin\AppData\Local\Temp\3f53aed02e3a0f3f353d1f644c769c768e9ea9ce3dbeeb708e8af3ee98b4b534.exe
        "C:\Users\Admin\AppData\Local\Temp\3f53aed02e3a0f3f353d1f644c769c768e9ea9ce3dbeeb708e8af3ee98b4b534.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Checks computer location settings
        • Drops startup file
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2624
        • C:\Users\Admin\AppData\Local\Temp\Ref.exe
          "C:\Users\Admin\AppData\Local\Temp\Ref.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Drops startup file
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5084
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:904
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of AdjustPrivilegeToken
        PID:464

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Ref.exe

      Filesize

      1.8MB

      MD5

      09d6a4bbf1c2b63b79ee2e15ff6ba692

      SHA1

      3b4f242f1b41d602dfa7a38c772fa9c56f658eb3

      SHA256

      9e887e21b114cfd3cf2f6a5e6f9e384412ef9d5744f0db71778105cd4bf9ddb0

      SHA512

      1f7a0056b6bf3e6e06dafdcf224dcfdf8902a43a73d72c56e0ee5c3fdf7a7cdc07a818a3aa4848cd86a7e3518cf13a8eaf34ded77d0239c02a32d81adc8c1abd

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Item.vbs

      Filesize

      79B

      MD5

      5cc6340ecfdd2252048d5726e4e4a3d3

      SHA1

      b625b1c7737b69e244a53fffc04e5952b1151727

      SHA256

      063d636ae20ea2b438e2c13e130d0f1848361eb30019208e2da7c0aaaeb3c17e

      SHA512

      a1c53dfbb21a87762d3d4753dede1dea63df88f520273de74ccfb4a522e97608b13e33e88c7ff78b5ac1a4887fdfac07641a3d66d50ebf8390cfd7149f5a4536

    • \??\c:\users\admin\appdata\roaming\item.exe

      Filesize

      1.8MB

      MD5

      ab3146b84c2c6a25fe5616cfdda6f38e

      SHA1

      d23f152b52f8470dbd11fe9d457f18514fff2cae

      SHA256

      007c3b33e51ead18001534f9aaafe2977ac05ee5da7322b5512d4668c349322d

      SHA512

      100a3281cfeb10b0f5fbcfcc6d06b35adc34e7228f6f945e8b8ba0cd1c3cdd9fd8d3b8282ebb3f8cfb395b77bb94ae6e86b3abf4693068a01da0259b8896f6d4

    • memory/464-3261-0x0000000005960000-0x000000000596A000-memory.dmp

      Filesize

      40KB

    • memory/464-3259-0x0000000005630000-0x0000000005686000-memory.dmp

      Filesize

      344KB

    • memory/464-2404-0x0000000000400000-0x00000000004B4000-memory.dmp

      Filesize

      720KB

    • memory/464-2405-0x0000000005310000-0x00000000053D6000-memory.dmp

      Filesize

      792KB

    • memory/904-3260-0x0000000005F10000-0x0000000005F60000-memory.dmp

      Filesize

      320KB

    • memory/904-3262-0x0000000074800000-0x0000000074FB0000-memory.dmp

      Filesize

      7.7MB

    • memory/904-1215-0x0000000004AC0000-0x0000000004B26000-memory.dmp

      Filesize

      408KB

    • memory/904-1216-0x0000000074800000-0x0000000074FB0000-memory.dmp

      Filesize

      7.7MB

    • memory/904-1214-0x0000000000190000-0x00000000001D0000-memory.dmp

      Filesize

      256KB

    • memory/904-1213-0x0000000074800000-0x0000000074FB0000-memory.dmp

      Filesize

      7.7MB

    • memory/2624-47-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-1184-0x0000000006A90000-0x0000000006ADC000-memory.dmp

      Filesize

      304KB

    • memory/2624-51-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-49-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-0-0x000000007480E000-0x000000007480F000-memory.dmp

      Filesize

      4KB

    • memory/2624-45-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-41-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-39-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-37-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-35-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-33-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-31-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-29-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-25-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-23-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-21-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-19-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-17-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-15-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-13-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-11-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-9-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-69-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-65-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-63-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-61-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-1182-0x0000000074800000-0x0000000074FB0000-memory.dmp

      Filesize

      7.7MB

    • memory/2624-53-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-1183-0x0000000006CA0000-0x0000000006DA0000-memory.dmp

      Filesize

      1024KB

    • memory/2624-56-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-1193-0x000000007480E000-0x000000007480F000-memory.dmp

      Filesize

      4KB

    • memory/2624-1197-0x0000000007630000-0x0000000007684000-memory.dmp

      Filesize

      336KB

    • memory/2624-1-0x0000000000AB0000-0x0000000000B3E000-memory.dmp

      Filesize

      568KB

    • memory/2624-1203-0x0000000074800000-0x0000000074FB0000-memory.dmp

      Filesize

      7.7MB

    • memory/2624-2-0x0000000074800000-0x0000000074FB0000-memory.dmp

      Filesize

      7.7MB

    • memory/2624-3-0x00000000067B0000-0x0000000006940000-memory.dmp

      Filesize

      1.6MB

    • memory/2624-1209-0x0000000074800000-0x0000000074FB0000-memory.dmp

      Filesize

      7.7MB

    • memory/2624-4-0x0000000006EF0000-0x0000000007494000-memory.dmp

      Filesize

      5.6MB

    • memory/2624-57-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-59-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-1212-0x0000000074800000-0x0000000074FB0000-memory.dmp

      Filesize

      7.7MB

    • memory/2624-1210-0x0000000074800000-0x0000000074FB0000-memory.dmp

      Filesize

      7.7MB

    • memory/2624-67-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-7-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-5-0x00000000069F0000-0x0000000006A82000-memory.dmp

      Filesize

      584KB

    • memory/2624-6-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-27-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/2624-43-0x00000000067B0000-0x000000000693A000-memory.dmp

      Filesize

      1.5MB

    • memory/5084-2394-0x00000000065C0000-0x00000000066BC000-memory.dmp

      Filesize

      1008KB

    • memory/5084-1217-0x0000000006220000-0x00000000063AC000-memory.dmp

      Filesize

      1.5MB

    • memory/5084-2452-0x0000000074800000-0x0000000074FB0000-memory.dmp

      Filesize

      7.7MB

    • memory/5084-1208-0x0000000074800000-0x0000000074FB0000-memory.dmp

      Filesize

      7.7MB

    • memory/5084-1206-0x0000000074800000-0x0000000074FB0000-memory.dmp

      Filesize

      7.7MB

    • memory/5084-1202-0x0000000004EB0000-0x0000000004EB8000-memory.dmp

      Filesize

      32KB

    • memory/5084-1200-0x0000000000500000-0x00000000006DA000-memory.dmp

      Filesize

      1.9MB