Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
32s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
08/07/2020, 10:07
Static task
static1
Behavioral task
behavioral1
Sample
sssssssss.exe
Resource
win7v200430
General
-
Target
sssssssss.exe
-
Size
700KB
-
MD5
88eb02d25f5e8f949f9f0ae669066601
-
SHA1
3ef5319771bbff0b02eb9c7b0a0f21c942282eb4
-
SHA256
c75fa16118d5d921d598bd9ff539426dcfd7aece03815e5be6414763ba72bda6
-
SHA512
24fb08840a13e9da79c212d75bb374a54413ffe8b44c8d48ee640df02084b5ca1bb39182a8cad5c5e5570194b366d0e9bf77e01d8ce2cecf6317c821ad28e3bf
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.sensar-light.com - Port:
587 - Username:
[email protected] - Password:
chibuike12345@@@@@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
resource yara_rule behavioral1/memory/1432-1-0x00000000004A25C0-mapping.dmp family_agenttesla behavioral1/memory/1432-3-0x0000000000400000-0x00000000004A4000-memory.dmp family_agenttesla behavioral1/memory/1432-4-0x00000000002F0000-0x000000000033C000-memory.dmp family_agenttesla behavioral1/memory/1432-6-0x0000000000250000-0x0000000000296000-memory.dmp family_agenttesla -
resource yara_rule behavioral1/memory/1432-0-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral1/memory/1432-2-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral1/memory/1432-3-0x0000000000400000-0x00000000004A4000-memory.dmp upx -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1400 set thread context of 1432 1400 sssssssss.exe 24 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1400 sssssssss.exe 1432 sssssssss.exe 1432 sssssssss.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1400 sssssssss.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1432 sssssssss.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1400 wrote to memory of 1432 1400 sssssssss.exe 24 PID 1400 wrote to memory of 1432 1400 sssssssss.exe 24 PID 1400 wrote to memory of 1432 1400 sssssssss.exe 24 PID 1400 wrote to memory of 1432 1400 sssssssss.exe 24
Processes
-
C:\Users\Admin\AppData\Local\Temp\sssssssss.exe"C:\Users\Admin\AppData\Local\Temp\sssssssss.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\sssssssss.exe"C:\Users\Admin\AppData\Local\Temp\sssssssss.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432
-