Analysis
-
max time kernel
252s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06-12-2022 08:03
Static task
static1
Behavioral task
behavioral1
Sample
d37df64a441aae0025e509e08dace830.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d37df64a441aae0025e509e08dace830.exe
Resource
win10v2004-20220901-en
General
-
Target
d37df64a441aae0025e509e08dace830.exe
-
Size
670KB
-
MD5
d37df64a441aae0025e509e08dace830
-
SHA1
e466c3fd79844bde116aa7b372bde23316e9acd8
-
SHA256
5e63926b7ce5fb0d4bc1363397c655d0c3b29114497308db183b124b048c033f
-
SHA512
4ce48986a74c1e099e6177b865d41e950c2c073306c0464f7b060a696d217826081b1c4af355594694304dcb5eaffedfd7a6ff74defb9fd119bca5ace06039a7
-
SSDEEP
12288:iPuYd+V6b1momPZef5XmeFMGIhZNKfNo4uQYWOgBlpkLnLR0iFRnbGOOPuYd+V6b:iPuYd+V6bIomxi5XPyLKfN6QYPgj2zL
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5466358579:AAFHSCLt1chyZSTsCVrxZSdLSPQ_50Hs-ww/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
d37df64a441aae0025e509e08dace830.exedescription pid process target process PID 544 set thread context of 2000 544 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 43 IoCs
Processes:
d37df64a441aae0025e509e08dace830.exed37df64a441aae0025e509e08dace830.exepid process 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 544 d37df64a441aae0025e509e08dace830.exe 2000 d37df64a441aae0025e509e08dace830.exe 2000 d37df64a441aae0025e509e08dace830.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
d37df64a441aae0025e509e08dace830.exed37df64a441aae0025e509e08dace830.exedescription pid process Token: SeDebugPrivilege 544 d37df64a441aae0025e509e08dace830.exe Token: SeDebugPrivilege 2000 d37df64a441aae0025e509e08dace830.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
d37df64a441aae0025e509e08dace830.exedescription pid process target process PID 544 wrote to memory of 1660 544 d37df64a441aae0025e509e08dace830.exe powershell.exe PID 544 wrote to memory of 1660 544 d37df64a441aae0025e509e08dace830.exe powershell.exe PID 544 wrote to memory of 1660 544 d37df64a441aae0025e509e08dace830.exe powershell.exe PID 544 wrote to memory of 1660 544 d37df64a441aae0025e509e08dace830.exe powershell.exe PID 544 wrote to memory of 1840 544 d37df64a441aae0025e509e08dace830.exe schtasks.exe PID 544 wrote to memory of 1840 544 d37df64a441aae0025e509e08dace830.exe schtasks.exe PID 544 wrote to memory of 1840 544 d37df64a441aae0025e509e08dace830.exe schtasks.exe PID 544 wrote to memory of 1840 544 d37df64a441aae0025e509e08dace830.exe schtasks.exe PID 544 wrote to memory of 2000 544 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe PID 544 wrote to memory of 2000 544 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe PID 544 wrote to memory of 2000 544 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe PID 544 wrote to memory of 2000 544 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe PID 544 wrote to memory of 2000 544 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe PID 544 wrote to memory of 2000 544 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe PID 544 wrote to memory of 2000 544 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe PID 544 wrote to memory of 2000 544 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe PID 544 wrote to memory of 2000 544 d37df64a441aae0025e509e08dace830.exe d37df64a441aae0025e509e08dace830.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d37df64a441aae0025e509e08dace830.exe"C:\Users\Admin\AppData\Local\Temp\d37df64a441aae0025e509e08dace830.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TkIrKeUGaTLcN.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TkIrKeUGaTLcN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDD26.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\d37df64a441aae0025e509e08dace830.exe"C:\Users\Admin\AppData\Local\Temp\d37df64a441aae0025e509e08dace830.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpDD26.tmpFilesize
1KB
MD59df68008741fe4e8ed7f536e1ee08b87
SHA12896edec298f7e65d78ca2432acad556f49989bf
SHA2563181e48b3cb99f29be186fcc6633c0040629bb8360c973833e5b2d87eaf4c23e
SHA512be227ffa11c921fde62e17c6d5ba2e9e2af7e7413f573de2de9458d80ee1bdcfa269eef7c59c773c97ee9410cd65e8362831a55e0ad05321de2face9f25761fb
-
memory/544-55-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/544-56-0x00000000002F0000-0x000000000030A000-memory.dmpFilesize
104KB
-
memory/544-57-0x0000000000250000-0x000000000025E000-memory.dmpFilesize
56KB
-
memory/544-58-0x00000000050D0000-0x0000000005142000-memory.dmpFilesize
456KB
-
memory/544-65-0x00000000048A0000-0x00000000048D8000-memory.dmpFilesize
224KB
-
memory/544-54-0x0000000000A50000-0x0000000000AFE000-memory.dmpFilesize
696KB
-
memory/1660-63-0x000000006E400000-0x000000006E9AB000-memory.dmpFilesize
5.7MB
-
memory/1660-64-0x000000006E400000-0x000000006E9AB000-memory.dmpFilesize
5.7MB
-
memory/1660-59-0x0000000000000000-mapping.dmp
-
memory/1840-60-0x0000000000000000-mapping.dmp
-
memory/2000-66-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2000-67-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2000-69-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2000-70-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2000-71-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2000-72-0x00000000004324AE-mapping.dmp
-
memory/2000-74-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2000-76-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB