Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2024, 03:56 UTC

General

  • Target

    fdda2277625cf95b5fee831d58cf5ab0606bc81a832669c4c5f7469b5d7048e1.exe

  • Size

    208KB

  • MD5

    6c0c6a5a66f4ff1b21325cb9d069e115

  • SHA1

    73b0a7cff74ae8191f0cc33ba48053c260dc767f

  • SHA256

    fdda2277625cf95b5fee831d58cf5ab0606bc81a832669c4c5f7469b5d7048e1

  • SHA512

    dede722b3f3d0dfa4b97b296f35653f47c985079b691eea3e6e3c3e21a54b3236af940658f6887a36051583e6c6795afd00284cd951cbbea0222360a802b6be2

  • SSDEEP

    3072:6mnojXT/SrCpGWEg18eXIV0E7Wh8Ffdl/Q5UX6RUG4dFVc4mWSUansTZYRp7uIt2:6mnqIV0E7WhylUUX6RUGKcHflpN2k3

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.vvis.com.ph
  • Port:
    587
  • Username:
    fatima@vvis.com.ph
  • Password:
    May192017

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.vvis.com.ph
  • Port:
    587
  • Username:
    fatima@vvis.com.ph
  • Password:
    May192017
  • Email To:
    ranjqnupreti3@gmail.com

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Agenttesla family
  • Drops file in Drivers directory 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fdda2277625cf95b5fee831d58cf5ab0606bc81a832669c4c5f7469b5d7048e1.exe
    "C:\Users\Admin\AppData\Local\Temp\fdda2277625cf95b5fee831d58cf5ab0606bc81a832669c4c5f7469b5d7048e1.exe"
    1⤵
    • Drops file in Drivers directory
    • Accesses Microsoft Outlook profiles
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • outlook_office_path
    • outlook_win_path
    PID:5032

Network

  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    mail.vvis.com.ph
    fdda2277625cf95b5fee831d58cf5ab0606bc81a832669c4c5f7469b5d7048e1.exe
    Remote address:
    8.8.8.8:53
    Request
    mail.vvis.com.ph
    IN A
    Response
    mail.vvis.com.ph
    IN CNAME
    vvis.com.ph
    vvis.com.ph
    IN A
    46.21.149.90
  • flag-us
    DNS
    90.149.21.46.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    90.149.21.46.in-addr.arpa
    IN PTR
    Response
    90.149.21.46.in-addr.arpa
    IN PTR
    marblezoomph
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    107.12.20.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    107.12.20.2.in-addr.arpa
    IN PTR
    Response
    107.12.20.2.in-addr.arpa
    IN PTR
    a2-20-12-107deploystaticakamaitechnologiescom
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    31.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    31.243.111.52.in-addr.arpa
    IN PTR
    Response
  • 46.21.149.90:587
    mail.vvis.com.ph
    smtp-submission
    fdda2277625cf95b5fee831d58cf5ab0606bc81a832669c4c5f7469b5d7048e1.exe
    523 B
    945 B
    9
    12
  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    mail.vvis.com.ph
    dns
    fdda2277625cf95b5fee831d58cf5ab0606bc81a832669c4c5f7469b5d7048e1.exe
    62 B
    92 B
    1
    1

    DNS Request

    mail.vvis.com.ph

    DNS Response

    46.21.149.90

  • 8.8.8.8:53
    90.149.21.46.in-addr.arpa
    dns
    71 B
    99 B
    1
    1

    DNS Request

    90.149.21.46.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
    160 B
    1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    107.12.20.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    107.12.20.2.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    31.243.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    31.243.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5032-0-0x000000007514E000-0x000000007514F000-memory.dmp

    Filesize

    4KB

  • memory/5032-1-0x0000000000180000-0x00000000001BA000-memory.dmp

    Filesize

    232KB

  • memory/5032-2-0x0000000005210000-0x00000000057B4000-memory.dmp

    Filesize

    5.6MB

  • memory/5032-3-0x0000000004C60000-0x0000000004CFC000-memory.dmp

    Filesize

    624KB

  • memory/5032-4-0x0000000075140000-0x00000000758F0000-memory.dmp

    Filesize

    7.7MB

  • memory/5032-5-0x0000000004C10000-0x0000000004C28000-memory.dmp

    Filesize

    96KB

  • memory/5032-6-0x00000000051A0000-0x0000000005206000-memory.dmp

    Filesize

    408KB

  • memory/5032-9-0x0000000006100000-0x0000000006150000-memory.dmp

    Filesize

    320KB

  • memory/5032-10-0x000000007514E000-0x000000007514F000-memory.dmp

    Filesize

    4KB

  • memory/5032-11-0x0000000075140000-0x00000000758F0000-memory.dmp

    Filesize

    7.7MB

  • memory/5032-12-0x00000000062F0000-0x0000000006382000-memory.dmp

    Filesize

    584KB

  • memory/5032-13-0x0000000075140000-0x00000000758F0000-memory.dmp

    Filesize

    7.7MB

  • memory/5032-14-0x0000000006260000-0x000000000626A000-memory.dmp

    Filesize

    40KB

  • memory/5032-15-0x0000000075140000-0x00000000758F0000-memory.dmp

    Filesize

    7.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.