Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
89s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
07/02/2023, 15:22
Static task
static1
Behavioral task
behavioral1
Sample
AWB NO. 8148557141.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
AWB NO. 8148557141.exe
Resource
win10v2004-20221111-en
General
-
Target
AWB NO. 8148557141.exe
-
Size
792KB
-
MD5
a169ae631ac877e4e89d595b6ba03600
-
SHA1
4589dd4afc4a6c9423ddba7442137e5beb502fb0
-
SHA256
c1add17549206e0ea3e1025ec81ff8d7e5ae994381600ec84d33eeab50ea7232
-
SHA512
f2a639c226a6e092c664921fcb99dba63ca564e024f0be3b364951c55a842a5767a95c79f7afd1d61400c01c396eb346346e110f18e744613008def4d0e0bcf3
-
SSDEEP
12288:Nrt0wdeWKBp5gYcjzioNo5IhMbmfEJhJm6I6awHRr/CB06KuLpgbDDlG:NrGV7p55Ki7WhMKfCm6xawxO5dgZ
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6191932863:AAEw6WZfMHSbIiilSKsmAnJOgaZwvnoMVh8/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AWB NO. 8148557141.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AWB NO. 8148557141.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AWB NO. 8148557141.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 157 api.ipify.org 158 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4756 set thread context of 4264 4756 AWB NO. 8148557141.exe 91 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4756 AWB NO. 8148557141.exe 4756 AWB NO. 8148557141.exe 4756 AWB NO. 8148557141.exe 4756 AWB NO. 8148557141.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4756 AWB NO. 8148557141.exe Token: SeDebugPrivilege 4264 AWB NO. 8148557141.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4756 wrote to memory of 4264 4756 AWB NO. 8148557141.exe 91 PID 4756 wrote to memory of 4264 4756 AWB NO. 8148557141.exe 91 PID 4756 wrote to memory of 4264 4756 AWB NO. 8148557141.exe 91 PID 4756 wrote to memory of 4264 4756 AWB NO. 8148557141.exe 91 PID 4756 wrote to memory of 4264 4756 AWB NO. 8148557141.exe 91 PID 4756 wrote to memory of 4264 4756 AWB NO. 8148557141.exe 91 PID 4756 wrote to memory of 4264 4756 AWB NO. 8148557141.exe 91 PID 4756 wrote to memory of 4264 4756 AWB NO. 8148557141.exe 91 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AWB NO. 8148557141.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AWB NO. 8148557141.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AWB NO. 8148557141.exe"C:\Users\Admin\AppData\Local\Temp\AWB NO. 8148557141.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\AWB NO. 8148557141.exe"C:\Users\Admin\AppData\Local\Temp\AWB NO. 8148557141.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4264
-