Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
02-12-2023 02:25
Static task
static1
Behavioral task
behavioral1
Sample
6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe
Resource
win10v2004-20231127-en
General
-
Target
6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe
-
Size
676KB
-
MD5
86c92625a06644590f8f93f6aa5669db
-
SHA1
eceab13ad2b687af069dd80a60f714dd345d019c
-
SHA256
6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876
-
SHA512
2f04e694216d52ee2ccab165067d14641993d1fc770736d8a813e8cdff82729e1eefc5e8945b6dfd65e9166ba227139b1c35c3742e3e56bcdd5f4392e3a5957d
-
SSDEEP
12288:4v26JAeIIn3gXWRadHKP5jaLEPkyndhv0x5blcAciPGK:G26JA4MW+KP5jaLEHndhvY53DG
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.iaa-airferight.com - Port:
587 - Username:
[email protected] - Password:
29ftOO+6H-ivsG5A - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exedescription pid process target process PID 2016 set thread context of 2188 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exepowershell.exepowershell.exeRegSvcs.exepid process 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe 2776 powershell.exe 2668 powershell.exe 2188 RegSvcs.exe 2188 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe Token: SeDebugPrivilege 2776 powershell.exe Token: SeDebugPrivilege 2668 powershell.exe Token: SeDebugPrivilege 2188 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exedescription pid process target process PID 2016 wrote to memory of 2668 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe powershell.exe PID 2016 wrote to memory of 2668 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe powershell.exe PID 2016 wrote to memory of 2668 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe powershell.exe PID 2016 wrote to memory of 2668 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe powershell.exe PID 2016 wrote to memory of 2776 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe powershell.exe PID 2016 wrote to memory of 2776 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe powershell.exe PID 2016 wrote to memory of 2776 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe powershell.exe PID 2016 wrote to memory of 2776 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe powershell.exe PID 2016 wrote to memory of 2760 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe schtasks.exe PID 2016 wrote to memory of 2760 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe schtasks.exe PID 2016 wrote to memory of 2760 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe schtasks.exe PID 2016 wrote to memory of 2760 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe schtasks.exe PID 2016 wrote to memory of 2188 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe RegSvcs.exe PID 2016 wrote to memory of 2188 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe RegSvcs.exe PID 2016 wrote to memory of 2188 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe RegSvcs.exe PID 2016 wrote to memory of 2188 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe RegSvcs.exe PID 2016 wrote to memory of 2188 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe RegSvcs.exe PID 2016 wrote to memory of 2188 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe RegSvcs.exe PID 2016 wrote to memory of 2188 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe RegSvcs.exe PID 2016 wrote to memory of 2188 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe RegSvcs.exe PID 2016 wrote to memory of 2188 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe RegSvcs.exe PID 2016 wrote to memory of 2188 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe RegSvcs.exe PID 2016 wrote to memory of 2188 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe RegSvcs.exe PID 2016 wrote to memory of 2188 2016 6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe"C:\Users\Admin\AppData\Local\Temp\6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6a1ef6c9c4a269735ad4093d064dd1c673c32bd24ebdcb8dd01c80d9e9e24876.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dUtDhaePto.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dUtDhaePto" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB1D2.tmp"2⤵
- Creates scheduled task(s)
PID:2760 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5fcafc6e3a9a9e5bdac87462b7abdbe89
SHA164ce456a3995b186a40189a7a4d6e5abe952580f
SHA256f6373fe3521cf8ba78f37876e2d2c6ddc22358e6df98dfab7011ef076a28b1a8
SHA51208e58a18b95861727fec9558fba8e8755330f782d0c1c6077bed72984396d7380cd65f658f05933fd9246d84f7c4c02e67dbc65f807a37425966171d4583430a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PXNMLY0HZWQW6159IH6S.temp
Filesize7KB
MD5b674d069ca8d20d918838c0aa257e9dd
SHA1db8264dcf9457049b5081919759cc43bedd5f2e0
SHA256af1623f1991aafd4f0fd129eb7a92f42a75a8eec90bbf9ac12f8b2a26ccea0bb
SHA512a76d078dcd560be4928128a764e51d47999a94eaed5f71e9c47f6ec86a976f27b9ff033b67228e77cce5a8873f9392833131ddc2209d2f4887fb4f9b498a19d2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5b674d069ca8d20d918838c0aa257e9dd
SHA1db8264dcf9457049b5081919759cc43bedd5f2e0
SHA256af1623f1991aafd4f0fd129eb7a92f42a75a8eec90bbf9ac12f8b2a26ccea0bb
SHA512a76d078dcd560be4928128a764e51d47999a94eaed5f71e9c47f6ec86a976f27b9ff033b67228e77cce5a8873f9392833131ddc2209d2f4887fb4f9b498a19d2