Analysis

  • max time kernel
    136s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/05/2025, 22:10

General

  • Target

    SwiftRef_INV0880021122020.exe

  • Size

    441KB

  • MD5

    590fb4682dfff1f638befdd634ef2e65

  • SHA1

    aaf785e8893b86f22b28a5badebaa59de0969d83

  • SHA256

    df0bd7eda7bc8058d76a69f26c62a909b2910e41413f65311303a542758f3187

  • SHA512

    400b18d7f4d310e5aa33683f98f6d947097658a0c20d6065647ce139188a72fe92eb5f0ae0c769c4b5100be8c76861632881f210926091be29b48c3afa92a5cd

  • SSDEEP

    6144:cNWBZARLCD0fAaAIyTTG6eOOIbuXKvyUTQoEevzsHBhv1ucFQTatxu8RWjI2j5Om:BD7I3TyTReOz8aQezIBhdxiaO8Rj2

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.vivaldi.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    @2222!444211

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Agenttesla family
  • AgentTesla payload 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SwiftRef_INV0880021122020.exe
    "C:\Users\Admin\AppData\Local\Temp\SwiftRef_INV0880021122020.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Users\Admin\AppData\Local\Temp\SwiftRef_INV0880021122020.exe
      "{path}"
      2⤵
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:4756

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SwiftRef_INV0880021122020.exe.log

          Filesize

          1KB

          MD5

          b7b9acb869ccc7f7ecb5304ec0384dee

          SHA1

          6a90751c95817903ee833d59a0abbef425a613b3

          SHA256

          8cb00a15cd942a1861c573d86d6fb430512c8e2f80f6349f48b16b8709ca7aa4

          SHA512

          7bec881ac5f59ac26f1be1e7e26d63f040c06369de10c1c246e531a4395d27c335d9acc647ecdedb48ed37bdc2dc405a4cfc11762e1c00659a49be259eaf8764

        • memory/3024-6-0x0000000005770000-0x000000000577A000-memory.dmp

          Filesize

          40KB

        • memory/3024-2-0x00000000057E0000-0x0000000005D84000-memory.dmp

          Filesize

          5.6MB

        • memory/3024-3-0x00000000052D0000-0x0000000005362000-memory.dmp

          Filesize

          584KB

        • memory/3024-4-0x0000000005370000-0x00000000056C4000-memory.dmp

          Filesize

          3.3MB

        • memory/3024-5-0x0000000074470000-0x0000000074C20000-memory.dmp

          Filesize

          7.7MB

        • memory/3024-16-0x0000000074470000-0x0000000074C20000-memory.dmp

          Filesize

          7.7MB

        • memory/3024-7-0x0000000005F60000-0x0000000005F74000-memory.dmp

          Filesize

          80KB

        • memory/3024-8-0x000000007447E000-0x000000007447F000-memory.dmp

          Filesize

          4KB

        • memory/3024-9-0x0000000074470000-0x0000000074C20000-memory.dmp

          Filesize

          7.7MB

        • memory/3024-10-0x00000000080E0000-0x000000000813C000-memory.dmp

          Filesize

          368KB

        • memory/3024-11-0x00000000081E0000-0x000000000827C000-memory.dmp

          Filesize

          624KB

        • memory/3024-0-0x000000007447E000-0x000000007447F000-memory.dmp

          Filesize

          4KB

        • memory/3024-1-0x0000000000800000-0x0000000000874000-memory.dmp

          Filesize

          464KB

        • memory/4756-12-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/4756-15-0x0000000074470000-0x0000000074C20000-memory.dmp

          Filesize

          7.7MB

        • memory/4756-17-0x0000000074470000-0x0000000074C20000-memory.dmp

          Filesize

          7.7MB

        • memory/4756-18-0x00000000064A0000-0x00000000064B8000-memory.dmp

          Filesize

          96KB

        • memory/4756-19-0x0000000006540000-0x00000000065A6000-memory.dmp

          Filesize

          408KB

        • memory/4756-20-0x0000000074470000-0x0000000074C20000-memory.dmp

          Filesize

          7.7MB

        • memory/4756-21-0x0000000074470000-0x0000000074C20000-memory.dmp

          Filesize

          7.7MB

        • memory/4756-22-0x0000000001580000-0x00000000015D0000-memory.dmp

          Filesize

          320KB

        • memory/4756-23-0x0000000074470000-0x0000000074C20000-memory.dmp

          Filesize

          7.7MB

        • memory/4756-24-0x0000000074470000-0x0000000074C20000-memory.dmp

          Filesize

          7.7MB

        OSZAR »