Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
63s -
max time network
28s -
platform
windows7_x64 -
resource
win7 -
submitted
07/07/2020, 08:39
Static task
static1
Behavioral task
behavioral1
Sample
Q0001DA.exe
Resource
win7
General
-
Target
Q0001DA.exe
-
Size
791KB
-
MD5
0cbe236bd971b3c66eae0105b9d1b963
-
SHA1
16a54302d3404dd169d90bb0b82922d6aabb35cd
-
SHA256
f6e1d512e3da60314732745faefb71123ec48154575d3b621546fc55e78e7a3c
-
SHA512
b4a72096a160530fbe629e0a800ebcad7ac7c479ce9774772e7d5847292e63d270f8cd26f8027dadf4ea593e96430a0380b181ea286939fd74d63c22d735a448
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
Mix2lower12?..
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
resource yara_rule behavioral1/memory/1404-5-0x0000000000400000-0x00000000004A5000-memory.dmp family_agenttesla behavioral1/memory/1404-6-0x0000000001D10000-0x0000000001D5C000-memory.dmp family_agenttesla behavioral1/memory/1404-8-0x0000000001C20000-0x0000000001C67000-memory.dmp family_agenttesla -
resource yara_rule behavioral1/memory/1404-2-0x0000000000400000-0x00000000004A5000-memory.dmp upx behavioral1/memory/1404-4-0x0000000000400000-0x00000000004A5000-memory.dmp upx behavioral1/memory/1404-5-0x0000000000400000-0x00000000004A5000-memory.dmp upx -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Q0001DA.vbs notepad.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1312 set thread context of 1404 1312 Q0001DA.exe 25 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1312 Q0001DA.exe 1404 Q0001DA.exe 1404 Q0001DA.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1312 Q0001DA.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1404 Q0001DA.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1312 wrote to memory of 1280 1312 Q0001DA.exe 24 PID 1312 wrote to memory of 1280 1312 Q0001DA.exe 24 PID 1312 wrote to memory of 1280 1312 Q0001DA.exe 24 PID 1312 wrote to memory of 1280 1312 Q0001DA.exe 24 PID 1312 wrote to memory of 1280 1312 Q0001DA.exe 24 PID 1312 wrote to memory of 1280 1312 Q0001DA.exe 24 PID 1312 wrote to memory of 1404 1312 Q0001DA.exe 25 PID 1312 wrote to memory of 1404 1312 Q0001DA.exe 25 PID 1312 wrote to memory of 1404 1312 Q0001DA.exe 25 PID 1312 wrote to memory of 1404 1312 Q0001DA.exe 25
Processes
-
C:\Users\Admin\AppData\Local\Temp\Q0001DA.exe"C:\Users\Admin\AppData\Local\Temp\Q0001DA.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
PID:1280
-
-
C:\Users\Admin\AppData\Local\Temp\Q0001DA.exe"C:\Users\Admin\AppData\Local\Temp\Q0001DA.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1404
-