Analysis
-
max time kernel
29s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
29-03-2023 05:26
Static task
static1
Behavioral task
behavioral1
Sample
p004575839574947.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
p004575839574947.exe
Resource
win10v2004-20230220-en
General
-
Target
p004575839574947.exe
-
Size
1.1MB
-
MD5
f90d87222db82285ce87a988b372524a
-
SHA1
b4a571be12134d9ff6c91fc8fc46b8f53ba3d176
-
SHA256
53873190e732fcbe931729aadb3d4f878d74bd17dc64c282b4efa1f87d021b43
-
SHA512
299c35d9c16ce2479b104787d04f50f644db735f540a148d07cef32a78f01343d15b9c7610ebd88482eec76e600c80f4b33152228d4af69cf43c29aa72a4e116
-
SSDEEP
12288:00ZeZOUnaKuQdJFUbDLYqid+3eo9geDCknIfblyi7uDvOI8fpXVNLhc5LiJMUZCp:9KgoYi3ImgiSs/1cNQz9oG
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.focuzpartsmart.com - Port:
587 - Username:
johnsonpc@focuzpartsmart.com - Password:
FpmJhn@2023 - Email To:
jinhux31@gmail.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
p004575839574947.exedescription pid process target process PID 1484 set thread context of 856 1484 p004575839574947.exe Setup.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 268 856 WerFault.exe Setup.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
p004575839574947.exepid process 1484 p004575839574947.exe 1484 p004575839574947.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
p004575839574947.exedescription pid process Token: SeDebugPrivilege 1484 p004575839574947.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
p004575839574947.exeSetup.exedescription pid process target process PID 1484 wrote to memory of 948 1484 p004575839574947.exe AppLaunch.exe PID 1484 wrote to memory of 948 1484 p004575839574947.exe AppLaunch.exe PID 1484 wrote to memory of 948 1484 p004575839574947.exe AppLaunch.exe PID 1484 wrote to memory of 900 1484 p004575839574947.exe aspnet_regbrowsers.exe PID 1484 wrote to memory of 900 1484 p004575839574947.exe aspnet_regbrowsers.exe PID 1484 wrote to memory of 900 1484 p004575839574947.exe aspnet_regbrowsers.exe PID 1484 wrote to memory of 856 1484 p004575839574947.exe Setup.exe PID 1484 wrote to memory of 856 1484 p004575839574947.exe Setup.exe PID 1484 wrote to memory of 856 1484 p004575839574947.exe Setup.exe PID 1484 wrote to memory of 856 1484 p004575839574947.exe Setup.exe PID 1484 wrote to memory of 856 1484 p004575839574947.exe Setup.exe PID 1484 wrote to memory of 856 1484 p004575839574947.exe Setup.exe PID 1484 wrote to memory of 856 1484 p004575839574947.exe Setup.exe PID 1484 wrote to memory of 856 1484 p004575839574947.exe Setup.exe PID 1484 wrote to memory of 856 1484 p004575839574947.exe Setup.exe PID 1484 wrote to memory of 856 1484 p004575839574947.exe Setup.exe PID 1484 wrote to memory of 856 1484 p004575839574947.exe Setup.exe PID 1484 wrote to memory of 856 1484 p004575839574947.exe Setup.exe PID 856 wrote to memory of 268 856 Setup.exe WerFault.exe PID 856 wrote to memory of 268 856 Setup.exe WerFault.exe PID 856 wrote to memory of 268 856 Setup.exe WerFault.exe PID 856 wrote to memory of 268 856 Setup.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\p004575839574947.exe"C:\Users\Admin\AppData\Local\Temp\p004575839574947.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 3043⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/856-57-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1484-54-0x0000000000180000-0x00000000002A6000-memory.dmpFilesize
1.1MB
-
memory/1484-55-0x0000000000740000-0x00000000007B0000-memory.dmpFilesize
448KB
-
memory/1484-56-0x000000001AFC0000-0x000000001B040000-memory.dmpFilesize
512KB