Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
03/10/2023, 06:26
Static task
static1
Behavioral task
behavioral1
Sample
audiodgs.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
audiodgs.exe
Resource
win10v2004-20230915-en
General
-
Target
audiodgs.exe
-
Size
608KB
-
MD5
bb7de5ae335e010647c6d775a6b5ba65
-
SHA1
34fc011c6b4d9e2268620a1dd40413127c09a275
-
SHA256
f5970e4e030d40597a3f67287136f2044c51354e333008c8455c668622ddbfd1
-
SHA512
ffd9ab82fdc60a215943070410ba297cc844e4da5beb4b253b40c49e92ba0973ed0069aa5850eda1a45f0e142ed15c2c43097ae24afedeaa66793daa5792a1a4
-
SSDEEP
12288:NMYnQ3j67SESV1eXl8OhA90X91cYWTBnNVKGML4miAiesWUMGanQeL6+AF5GZv9T:NBX9KrFnNVNbAiHyhyF5Gt9HGr70
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.zqamcx.com - Port:
587 - Username:
[email protected] - Password:
method5000@ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 audiodgs.exe Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 audiodgs.exe Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 audiodgs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows\CurrentVersion\Run\YawnMo = "C:\\Users\\Admin\\AppData\\Roaming\\YawnMo\\YawnMo.exe" audiodgs.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2256 set thread context of 2644 2256 audiodgs.exe 30 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2256 audiodgs.exe 2256 audiodgs.exe 2644 audiodgs.exe 2644 audiodgs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2256 audiodgs.exe Token: SeDebugPrivilege 2644 audiodgs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2644 audiodgs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2256 wrote to memory of 1676 2256 audiodgs.exe 28 PID 2256 wrote to memory of 1676 2256 audiodgs.exe 28 PID 2256 wrote to memory of 1676 2256 audiodgs.exe 28 PID 2256 wrote to memory of 1676 2256 audiodgs.exe 28 PID 2256 wrote to memory of 2764 2256 audiodgs.exe 29 PID 2256 wrote to memory of 2764 2256 audiodgs.exe 29 PID 2256 wrote to memory of 2764 2256 audiodgs.exe 29 PID 2256 wrote to memory of 2764 2256 audiodgs.exe 29 PID 2256 wrote to memory of 2644 2256 audiodgs.exe 30 PID 2256 wrote to memory of 2644 2256 audiodgs.exe 30 PID 2256 wrote to memory of 2644 2256 audiodgs.exe 30 PID 2256 wrote to memory of 2644 2256 audiodgs.exe 30 PID 2256 wrote to memory of 2644 2256 audiodgs.exe 30 PID 2256 wrote to memory of 2644 2256 audiodgs.exe 30 PID 2256 wrote to memory of 2644 2256 audiodgs.exe 30 PID 2256 wrote to memory of 2644 2256 audiodgs.exe 30 PID 2256 wrote to memory of 2644 2256 audiodgs.exe 30 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 audiodgs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 audiodgs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\audiodgs.exe"C:\Users\Admin\AppData\Local\Temp\audiodgs.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\audiodgs.exe"C:\Users\Admin\AppData\Local\Temp\audiodgs.exe"2⤵PID:1676
-
-
C:\Users\Admin\AppData\Local\Temp\audiodgs.exe"C:\Users\Admin\AppData\Local\Temp\audiodgs.exe"2⤵PID:2764
-
-
C:\Users\Admin\AppData\Local\Temp\audiodgs.exe"C:\Users\Admin\AppData\Local\Temp\audiodgs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:2644
-