Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
136s -
platform
windows10_x64 -
resource
win10 -
submitted
08/07/2020, 10:07
Static task
static1
Behavioral task
behavioral1
Sample
sssssssss.exe
Resource
win7v200430
General
-
Target
sssssssss.exe
-
Size
700KB
-
MD5
88eb02d25f5e8f949f9f0ae669066601
-
SHA1
3ef5319771bbff0b02eb9c7b0a0f21c942282eb4
-
SHA256
c75fa16118d5d921d598bd9ff539426dcfd7aece03815e5be6414763ba72bda6
-
SHA512
24fb08840a13e9da79c212d75bb374a54413ffe8b44c8d48ee640df02084b5ca1bb39182a8cad5c5e5570194b366d0e9bf77e01d8ce2cecf6317c821ad28e3bf
Malware Config
Extracted
Protocol: smtp- Host:
mail.sensar-light.com - Port:
587 - Username:
[email protected] - Password:
chibuike12345@@@@@
Extracted
agenttesla
Protocol: smtp- Host:
mail.sensar-light.com - Port:
587 - Username:
[email protected] - Password:
chibuike12345@@@@@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
resource yara_rule behavioral2/memory/2980-3-0x0000000000400000-0x00000000004A4000-memory.dmp family_agenttesla behavioral2/memory/2980-4-0x00000000009B0000-0x00000000009FC000-memory.dmp family_agenttesla -
resource yara_rule behavioral2/memory/2980-0-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/2980-2-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/2980-3-0x0000000000400000-0x00000000004A4000-memory.dmp upx -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2920 set thread context of 2980 2920 sssssssss.exe 67 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2920 sssssssss.exe 2920 sssssssss.exe 2980 sssssssss.exe 2980 sssssssss.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2920 sssssssss.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2980 sssssssss.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2920 wrote to memory of 2980 2920 sssssssss.exe 67 PID 2920 wrote to memory of 2980 2920 sssssssss.exe 67 PID 2920 wrote to memory of 2980 2920 sssssssss.exe 67
Processes
-
C:\Users\Admin\AppData\Local\Temp\sssssssss.exe"C:\Users\Admin\AppData\Local\Temp\sssssssss.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\sssssssss.exe"C:\Users\Admin\AppData\Local\Temp\sssssssss.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980
-