Overview

overview

10

Static

static

3

Alternate.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Alternate.exe

  • Size

    1.7MB

  • Sample

    240630-akzmxstdpp

  • MD5

    3e5d1ab325607d0f82312fe983ed2d85

  • SHA1

    e13233716978488bd5b1ff4932a040306ee66bee

  • SHA256

    a0b94dfac3f39b128343ca2fde3ef807c85e3c19ad1971dcd7d16480711c8db5

  • SHA512

    a7a2ad1047ec968e72ead74dd1b975b3d38d05b35be5f3456772eeb79aebbf31dd9c2dd782cc0128948e31eecc26e2e90d1a7b17e4f0f17f2e5415c521fb8cc8

  • SSDEEP

    24576:b4gs0NWUF54sXuaJ8cOpZO3gFDbK+TkmIYR3T7Vr+umAnxvlouLqi9h2K:MI4vDC5OpZO3gFDb/TkmIYZVqsnMmO

Score
10/10
agentteslastealeriumcollectionkeyloggerpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1256630214449172480/KPSOBnkaIxsSCBfUjQjFjqFs81SqowDleEn5uuMYiQyvvhycJrsUT_kLVBqKjx_ijiXR

Targets

    • Target

      Alternate.exe

    • Size

      1.7MB

    • MD5

      3e5d1ab325607d0f82312fe983ed2d85

    • SHA1

      e13233716978488bd5b1ff4932a040306ee66bee

    • SHA256

      a0b94dfac3f39b128343ca2fde3ef807c85e3c19ad1971dcd7d16480711c8db5

    • SHA512

      a7a2ad1047ec968e72ead74dd1b975b3d38d05b35be5f3456772eeb79aebbf31dd9c2dd782cc0128948e31eecc26e2e90d1a7b17e4f0f17f2e5415c521fb8cc8

    • SSDEEP

      24576:b4gs0NWUF54sXuaJ8cOpZO3gFDbK+TkmIYR3T7Vr+umAnxvlouLqi9h2K:MI4vDC5OpZO3gFDb/TkmIYZVqsnMmO

    Score
    10/10
    agentteslastealeriumcollectionkeyloggerpersistenceprivilege_escalationspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Stealerium

      An open source info stealer written in C# first seen in May 2022.

      stealerstealerium

    • AgentTesla payload

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks