Analysis

  • max time kernel
    145s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250610-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/07/2025, 07:13

General

  • Target

    Procentdelene.exe

  • Size

    870KB

  • MD5

    68786837fdc79d05d4d183f7e4dd1546

  • SHA1

    a28c215c0c5c807f05e44063fbaf69526cf7f3b7

  • SHA256

    1eb25e230346fb5ff10dfd8daad216200205b958046fb2729b8666ba2f18f2a9

  • SHA512

    24af354f735e24ced6c4fa83e72d7a10ea97fefb6b09201b5b2d91b2a5b97d5cace1c44624e06168a81672c68db0fdb0c41b40020beaf7e66967c73002bd0284

  • SSDEEP

    24576:GFMMMMMMMMMMj9sbv93+MEySx9KNQ6SW/AJIoK:GFMMMMMMMMMMjY+MEycKm69/AU

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://inhanoi.net.vn
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    ^TSt3!FK$UBA

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Agenttesla family
  • Guloader family
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Procentdelene.exe
    "C:\Users\Admin\AppData\Local\Temp\Procentdelene.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4540
    • C:\Users\Admin\AppData\Local\Temp\Procentdelene.exe
      "C:\Users\Admin\AppData\Local\Temp\Procentdelene.exe"
      2⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2860

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsvA22C.tmp\System.dll

          Filesize

          11KB

          MD5

          9625d5b1754bc4ff29281d415d27a0fd

          SHA1

          80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

          SHA256

          c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

          SHA512

          dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

        • memory/2860-32-0x0000000034C80000-0x0000000035224000-memory.dmp

          Filesize

          5.6MB

        • memory/2860-34-0x0000000035330000-0x0000000035396000-memory.dmp

          Filesize

          408KB

        • memory/2860-41-0x00000000353B0000-0x00000000353C0000-memory.dmp

          Filesize

          64KB

        • memory/2860-28-0x00000000771C8000-0x00000000771C9000-memory.dmp

          Filesize

          4KB

        • memory/2860-29-0x0000000077269000-0x000000007726A000-memory.dmp

          Filesize

          4KB

        • memory/2860-30-0x00000000004C0000-0x0000000001714000-memory.dmp

          Filesize

          18.3MB

        • memory/2860-40-0x0000000077269000-0x000000007726A000-memory.dmp

          Filesize

          4KB

        • memory/2860-31-0x00000000004C0000-0x0000000000500000-memory.dmp

          Filesize

          256KB

        • memory/2860-33-0x00000000353B0000-0x00000000353C0000-memory.dmp

          Filesize

          64KB

        • memory/2860-39-0x0000000001720000-0x0000000002460000-memory.dmp

          Filesize

          13.2MB

        • memory/2860-35-0x0000000035CA0000-0x0000000035CF0000-memory.dmp

          Filesize

          320KB

        • memory/2860-36-0x0000000035CF0000-0x0000000035D82000-memory.dmp

          Filesize

          584KB

        • memory/2860-37-0x0000000035DC0000-0x0000000035DCA000-memory.dmp

          Filesize

          40KB

        • memory/4540-25-0x0000000003500000-0x0000000004240000-memory.dmp

          Filesize

          13.2MB

        • memory/4540-26-0x0000000010004000-0x0000000010005000-memory.dmp

          Filesize

          4KB

        • memory/4540-27-0x0000000003500000-0x0000000004240000-memory.dmp

          Filesize

          13.2MB