Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/09/2023, 16:23

General

  • Target

    1693844525085627b7cf9bc306aa266e9305a77ee0a76dfb7cfee5affb59f76267a08f6833347.dat-decoded.exe

  • Size

    274KB

  • MD5

    9f0aeff878befa2b72bbc2405581d78b

  • SHA1

    2eeb08f4869864d14cab38d73dc539cde3077f60

  • SHA256

    a1528f5de37b949354a3cdd6e72ac966b4a0ec675d7a23b67af482ddcb94616d

  • SHA512

    a5a4a0df564466e11ba0a5ae61289155f35545eb1225a3d378c29f20d65375feec9e5d6f4f8b8048932de9d1999348edd710c70d677db67a438bba6444fdaa81

  • SSDEEP

    3072:9pMF0t5OFxrHqMqZoeRcqs4sdtYS6Z02ljQEZ5URUxeE/RkJxKbzhe:/MK54xOMqZ/HaTYJ3cE/xNavKb0

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6515194704:AAEmyYc4dwrlO5o21i36i_KXXTaRISiSia4/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Downloads MZ/PE file
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1693844525085627b7cf9bc306aa266e9305a77ee0a76dfb7cfee5affb59f76267a08f6833347.dat-decoded.exe
    "C:\Users\Admin\AppData\Local\Temp\1693844525085627b7cf9bc306aa266e9305a77ee0a76dfb7cfee5affb59f76267a08f6833347.dat-decoded.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:1368

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1368-1055-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/1368-1057-0x0000000074690000-0x0000000074E40000-memory.dmp

    Filesize

    7.7MB

  • memory/1368-1058-0x00000000059F0000-0x0000000005A00000-memory.dmp

    Filesize

    64KB

  • memory/1368-1059-0x0000000006BB0000-0x0000000006C00000-memory.dmp

    Filesize

    320KB

  • memory/1368-1060-0x0000000006CA0000-0x0000000006D3C000-memory.dmp

    Filesize

    624KB

  • memory/1368-1063-0x00000000059F0000-0x0000000005A00000-memory.dmp

    Filesize

    64KB

  • memory/1368-1062-0x0000000074690000-0x0000000074E40000-memory.dmp

    Filesize

    7.7MB

  • memory/1368-1061-0x0000000006C50000-0x0000000006C5A000-memory.dmp

    Filesize

    40KB

  • memory/4648-34-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-44-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-6-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-8-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-10-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-12-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-14-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-16-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-18-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-20-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-22-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-24-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-26-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-28-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-30-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-32-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-3-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-36-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-38-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-40-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-42-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-4-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-46-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-48-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-50-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-52-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-54-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-56-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-58-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-60-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-62-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-64-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-66-0x0000000006710000-0x00000000067B7000-memory.dmp

    Filesize

    668KB

  • memory/4648-1047-0x0000000074690000-0x0000000074E40000-memory.dmp

    Filesize

    7.7MB

  • memory/4648-1048-0x0000000005ED0000-0x0000000005ED1000-memory.dmp

    Filesize

    4KB

  • memory/4648-2-0x00000000055B0000-0x00000000055C0000-memory.dmp

    Filesize

    64KB

  • memory/4648-1-0x0000000074690000-0x0000000074E40000-memory.dmp

    Filesize

    7.7MB

  • memory/4648-0-0x0000000000BC0000-0x0000000000C0A000-memory.dmp

    Filesize

    296KB

  • memory/4648-1049-0x0000000006A10000-0x0000000006AA2000-memory.dmp

    Filesize

    584KB

  • memory/4648-1050-0x0000000006AB0000-0x0000000006B16000-memory.dmp

    Filesize

    408KB

  • memory/4648-1051-0x00000000055B0000-0x00000000055C0000-memory.dmp

    Filesize

    64KB

  • memory/4648-1052-0x0000000007300000-0x00000000078A4000-memory.dmp

    Filesize

    5.6MB

  • memory/4648-1056-0x0000000074690000-0x0000000074E40000-memory.dmp

    Filesize

    7.7MB