Analysis
-
max time kernel
143s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2023 10:22
Static task
static1
Behavioral task
behavioral1
Sample
PO. No. 5500371145.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
PO. No. 5500371145.exe
Resource
win10v2004-20231127-en
General
-
Target
PO. No. 5500371145.exe
-
Size
678KB
-
MD5
7f4f6e3789449c78b61f26d679cf5a2f
-
SHA1
377ca37dcf869dbc2c6207a4dd383f85b9f6b65d
-
SHA256
5ff36a084b23be3de1baeb6953f2d0488d8f1ea257d1b83d64ad8fb64bc8dc39
-
SHA512
b9c614984dd6ff1ef21874b8fde9eaedb14d9afe59e4c3c3525eff8212d4f7424366f5c5e95dc004fd9cf7e6bac29e8117b13174ba9ad6e3e9740612c08f4f47
-
SSDEEP
12288:GCB0JiIeS0K36xgYG86Ox2nzNwqIH2kGX3DwxV7ccqidnuB/LhYcvwfqIrs9:l0Jis36aYv6Ox2xkGaxqFmcxa
Malware Config
Extracted
Protocol: smtp- Host:
mail.scorpionlogistics.qa - Port:
587 - Username:
[email protected] - Password:
M30009637
Extracted
agenttesla
Protocol: smtp- Host:
mail.scorpionlogistics.qa - Port:
587 - Username:
[email protected] - Password:
M30009637 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PO. No. 5500371145.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Control Panel\International\Geo\Nation PO. No. 5500371145.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
PO. No. 5500371145.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FdnCz = "C:\\Users\\Admin\\AppData\\Roaming\\FdnCz\\FdnCz.exe" PO. No. 5500371145.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 42 api.ipify.org 43 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO. No. 5500371145.exedescription pid process target process PID 5088 set thread context of 4308 5088 PO. No. 5500371145.exe PO. No. 5500371145.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
PO. No. 5500371145.exepowershell.exepowershell.exePO. No. 5500371145.exepid process 5088 PO. No. 5500371145.exe 3504 powershell.exe 2840 powershell.exe 5088 PO. No. 5500371145.exe 2840 powershell.exe 5088 PO. No. 5500371145.exe 3504 powershell.exe 4308 PO. No. 5500371145.exe 4308 PO. No. 5500371145.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PO. No. 5500371145.exepowershell.exepowershell.exePO. No. 5500371145.exedescription pid process Token: SeDebugPrivilege 5088 PO. No. 5500371145.exe Token: SeDebugPrivilege 3504 powershell.exe Token: SeDebugPrivilege 2840 powershell.exe Token: SeDebugPrivilege 4308 PO. No. 5500371145.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PO. No. 5500371145.exepid process 4308 PO. No. 5500371145.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
PO. No. 5500371145.exedescription pid process target process PID 5088 wrote to memory of 3504 5088 PO. No. 5500371145.exe powershell.exe PID 5088 wrote to memory of 3504 5088 PO. No. 5500371145.exe powershell.exe PID 5088 wrote to memory of 3504 5088 PO. No. 5500371145.exe powershell.exe PID 5088 wrote to memory of 2840 5088 PO. No. 5500371145.exe powershell.exe PID 5088 wrote to memory of 2840 5088 PO. No. 5500371145.exe powershell.exe PID 5088 wrote to memory of 2840 5088 PO. No. 5500371145.exe powershell.exe PID 5088 wrote to memory of 536 5088 PO. No. 5500371145.exe schtasks.exe PID 5088 wrote to memory of 536 5088 PO. No. 5500371145.exe schtasks.exe PID 5088 wrote to memory of 536 5088 PO. No. 5500371145.exe schtasks.exe PID 5088 wrote to memory of 4308 5088 PO. No. 5500371145.exe PO. No. 5500371145.exe PID 5088 wrote to memory of 4308 5088 PO. No. 5500371145.exe PO. No. 5500371145.exe PID 5088 wrote to memory of 4308 5088 PO. No. 5500371145.exe PO. No. 5500371145.exe PID 5088 wrote to memory of 4308 5088 PO. No. 5500371145.exe PO. No. 5500371145.exe PID 5088 wrote to memory of 4308 5088 PO. No. 5500371145.exe PO. No. 5500371145.exe PID 5088 wrote to memory of 4308 5088 PO. No. 5500371145.exe PO. No. 5500371145.exe PID 5088 wrote to memory of 4308 5088 PO. No. 5500371145.exe PO. No. 5500371145.exe PID 5088 wrote to memory of 4308 5088 PO. No. 5500371145.exe PO. No. 5500371145.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO. No. 5500371145.exe"C:\Users\Admin\AppData\Local\Temp\PO. No. 5500371145.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO. No. 5500371145.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3504 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mKYYhRtPkmXrC.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2840 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mKYYhRtPkmXrC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC7E.tmp"2⤵
- Creates scheduled task(s)
PID:536 -
C:\Users\Admin\AppData\Local\Temp\PO. No. 5500371145.exe"C:\Users\Admin\AppData\Local\Temp\PO. No. 5500371145.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4308
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD5cb49f3bb268dfc2c724feab7f99e93a8
SHA144973fd9ee4562828d239078f24205331ec7cb11
SHA256d4107cfcac09956b0b9bcdb40db8bf0ab769c61d157ba21f02dbec997a78c34f
SHA5125f2c226b11f8af47a14f3266424f48292114b197bbaab94b0bf9d99fca9839fade39a381cdf69a3d2f2d4e8f31287c4ca834e1fce1421b488a4647d2aa264056
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD58a6089142cc4a5feee9dfb8c329ec46d
SHA1d4d727d0680ffa7e3de584a4d421bd8cacde35aa
SHA256855cca24024242035d1fc4ffb37f051cbb35bc5fa93e740225087d48a8ff9164
SHA5129c79c07379f4b3da5f6f86519ad0316c0fd982e708f0204277afc9fbca8b4bbd4f3025d309a805db8d81f8683ee288472d0ea6741fd9f42e4500e2fedfeaf9bd