Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-01-2025 01:19
General
-
Target
0be53232c436fe0c83ebe734c96ba6a1c159d5fa7c502f3f68bd0493394267eb.exe
-
Size
1.1MB
-
MD5
802397fe452b9d4923795a1994041073
-
SHA1
6653cbad45033f45a677c546b5881325a20ce548
-
SHA256
0be53232c436fe0c83ebe734c96ba6a1c159d5fa7c502f3f68bd0493394267eb
-
SHA512
b34cceafc5b934abb416cf9ee458759087d0977cc0446d43544ceb4b84c36b7c25a182a768c92fdba07b178ad0eb4e51943a1500933d90ca6e387eabadf14af7
-
SSDEEP
24576:6NA3R5drXdtCIe4it73fmm4iS39FrW2Lz0hL6cKx7s3oFQYcEn7h:z5bti1fmmNStMgz0ucKxIo6w
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
esut96092
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0be53232c436fe0c83ebe734c96ba6a1c159d5fa7c502f3f68bd0493394267eb.exe"C:\Users\Admin\AppData\Local\Temp\0be53232c436fe0c83ebe734c96ba6a1c159d5fa7c502f3f68bd0493394267eb.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\76477236\hdutulcnv.pif"C:\76477236\hdutulcnv.pif" qgfvud.udr2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
655KB
MD5a75bc752c50fb74f7597c2bb59b93d43
SHA1d2dcd3d104b6b04f0828844aeda188798669b41f
SHA256877365dfcbe9d4896e9ca544c7d19e106ab78339edbc1bd410f2e11bd32cd2ee
SHA512e856238e3cb519786365faf17d0d590692fa991d9ca81e2fb8ce094cd090583f4ed1823b7ca9c0f702320398054ba682644a02f8d99d4e0f53733564611d3f97
-
Filesize
611KB
MD51c9d75251fabd04dec07d045f9bba7a9
SHA1fb6199a8f1e04fbede315729f317fda5d950e2ed
SHA256d67387247789e39452560b75c98221846b53ac9412294937d4bc4a041e6ae0ad
SHA512d8c9c949e917912186d1b8156c0d9a0a1b5cb7a48617bd4b9af15359d2aff74062bc051bbf915ada6d86a717021142cf3f5ad0a3b22c8fb4a1bf06392ec174eb
-
Filesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
Filesize
6.8MB
-
Filesize
4KB
-
Filesize
304KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
96KB
-
Filesize
408KB
-
Filesize
320KB
-
Filesize
40KB
