Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system -
submitted
02-12-2023 10:21
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe
Resource
win10v2004-20231127-en
General
-
Target
NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe
-
Size
622KB
-
MD5
ee58f332b2d27a1bdd8b0de098e6165c
-
SHA1
d0e9ec92594ef432758e63ab31f7751872c3573c
-
SHA256
06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b
-
SHA512
b9c1c84fad01332771dcdb26c833705eac7e0ec5aed399414e4c4f93a241907279415d2e1dd3acfccd8a9f042918f598377e1138ed87995fa6a2d9b4b13b517f
-
SSDEEP
12288:IqfLYYZXTyX0Tp+fkI5/Gh/tDpWNIIe8frsBP3MKJBPeaHwxX:bXTD+fkjDp+IIeOI539JBPLQ
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6462317492:AAGRLAwoTiA42PAg_wJuGwDb61KKicShMe4/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exedescription pid process target process PID 1872 set thread context of 2836 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exeRegSvcs.exepid process 2256 powershell.exe 2784 powershell.exe 2836 RegSvcs.exe 2836 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2256 powershell.exe Token: SeDebugPrivilege 2784 powershell.exe Token: SeDebugPrivilege 2836 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 2836 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exedescription pid process target process PID 1872 wrote to memory of 2256 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe powershell.exe PID 1872 wrote to memory of 2256 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe powershell.exe PID 1872 wrote to memory of 2256 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe powershell.exe PID 1872 wrote to memory of 2256 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe powershell.exe PID 1872 wrote to memory of 2784 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe powershell.exe PID 1872 wrote to memory of 2784 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe powershell.exe PID 1872 wrote to memory of 2784 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe powershell.exe PID 1872 wrote to memory of 2784 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe powershell.exe PID 1872 wrote to memory of 2800 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe schtasks.exe PID 1872 wrote to memory of 2800 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe schtasks.exe PID 1872 wrote to memory of 2800 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe schtasks.exe PID 1872 wrote to memory of 2800 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe schtasks.exe PID 1872 wrote to memory of 2836 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe RegSvcs.exe PID 1872 wrote to memory of 2836 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe RegSvcs.exe PID 1872 wrote to memory of 2836 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe RegSvcs.exe PID 1872 wrote to memory of 2836 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe RegSvcs.exe PID 1872 wrote to memory of 2836 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe RegSvcs.exe PID 1872 wrote to memory of 2836 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe RegSvcs.exe PID 1872 wrote to memory of 2836 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe RegSvcs.exe PID 1872 wrote to memory of 2836 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe RegSvcs.exe PID 1872 wrote to memory of 2836 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe RegSvcs.exe PID 1872 wrote to memory of 2836 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe RegSvcs.exe PID 1872 wrote to memory of 2836 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe RegSvcs.exe PID 1872 wrote to memory of 2836 1872 NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\NEAS.06c8a5695959ee2655fb9a537cf855398a4c814000b20d3af61c93f16e21b69b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2256 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OwXxtNQRoml.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OwXxtNQRoml" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4E01.tmp"2⤵
- Creates scheduled task(s)
PID:2800 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2836
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50374199d8f4561389b91b3ad98f57562
SHA1a86bba45f8f56c0b67280c91a03873210606a050
SHA256745239a93f6afc3ea2ace384a7ebc0a1d27887c5c5ea7e0abfcf57c52e981e31
SHA51255ba78d4344ca8ef9eeb4e2d961348c6e5813d7567cbb461878cbbfee111990355898e9d7584ef688054920a72b3f92ef326903c9b2c7cc4b2885ee3bfd847bc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XT83O278PA1XRVBDAAUH.temp
Filesize7KB
MD5eb62b50589956874bd9ed15599edb1eb
SHA17d1db9a3552c65a0a3ccff592ebd98eb9ebb51fc
SHA2567d0a352c53c9db262cb2d015e84d22c6ec978e5e3603d6da5a95c87ea55c15d9
SHA512a1a5e7ccfe2120fd4afc3986fbc2aef975df8cd7a841598b0a98fc23b480f8824442a1ecf38130a89edce637e9f77f74cba9cdcd18b8cec32fe93756e46979ab
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5eb62b50589956874bd9ed15599edb1eb
SHA17d1db9a3552c65a0a3ccff592ebd98eb9ebb51fc
SHA2567d0a352c53c9db262cb2d015e84d22c6ec978e5e3603d6da5a95c87ea55c15d9
SHA512a1a5e7ccfe2120fd4afc3986fbc2aef975df8cd7a841598b0a98fc23b480f8824442a1ecf38130a89edce637e9f77f74cba9cdcd18b8cec32fe93756e46979ab