Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system -
submitted
03-12-2023 02:35
Static task
static1
Behavioral task
behavioral1
Sample
5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe
Resource
win10v2004-20231130-en
General
-
Target
5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe
-
Size
1.0MB
-
MD5
914b506cc02b0d32af5434361f70c288
-
SHA1
90954ee530a99352a521bcfc90daa7f440cecd47
-
SHA256
5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec
-
SHA512
392fa1b3e4d6c84aa23348db64ebaeaad0187e582eff4cd1eec69fc753cf448088de7276260c87f85b80170f1ee06ec41dc4c6e09251dddd0201530488a776cb
-
SSDEEP
24576:/hWuTAus3WC8ACInEc4aL1aJbyq4zflPWwdnLS2ze:UuTKoMahyq4kwNn
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.globalifb.com - Port:
587 - Username:
[email protected] - Password:
jZjG(lw$CZo% - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exedescription pid process target process PID 1080 set thread context of 2604 1080 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 2604 set thread context of 2688 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1404 schtasks.exe 1704 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exe5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exepowershell.exe5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exepid process 1524 powershell.exe 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 1124 powershell.exe 2688 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 2688 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exe5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exepowershell.exe5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exedescription pid process Token: SeDebugPrivilege 1524 powershell.exe Token: SeDebugPrivilege 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe Token: SeDebugPrivilege 1124 powershell.exe Token: SeDebugPrivilege 2688 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exepid process 2688 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exedescription pid process target process PID 1080 wrote to memory of 1524 1080 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe powershell.exe PID 1080 wrote to memory of 1524 1080 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe powershell.exe PID 1080 wrote to memory of 1524 1080 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe powershell.exe PID 1080 wrote to memory of 1524 1080 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe powershell.exe PID 1080 wrote to memory of 1404 1080 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe schtasks.exe PID 1080 wrote to memory of 1404 1080 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe schtasks.exe PID 1080 wrote to memory of 1404 1080 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe schtasks.exe PID 1080 wrote to memory of 1404 1080 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe schtasks.exe PID 1080 wrote to memory of 2604 1080 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 1080 wrote to memory of 2604 1080 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 1080 wrote to memory of 2604 1080 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 1080 wrote to memory of 2604 1080 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 1080 wrote to memory of 2604 1080 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 1080 wrote to memory of 2604 1080 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 1080 wrote to memory of 2604 1080 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 1080 wrote to memory of 2604 1080 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 1080 wrote to memory of 2604 1080 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 2604 wrote to memory of 1124 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe powershell.exe PID 2604 wrote to memory of 1124 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe powershell.exe PID 2604 wrote to memory of 1124 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe powershell.exe PID 2604 wrote to memory of 1124 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe powershell.exe PID 2604 wrote to memory of 1704 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe schtasks.exe PID 2604 wrote to memory of 1704 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe schtasks.exe PID 2604 wrote to memory of 1704 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe schtasks.exe PID 2604 wrote to memory of 1704 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe schtasks.exe PID 2604 wrote to memory of 2424 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 2604 wrote to memory of 2424 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 2604 wrote to memory of 2424 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 2604 wrote to memory of 2424 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 2604 wrote to memory of 2688 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 2604 wrote to memory of 2688 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 2604 wrote to memory of 2688 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 2604 wrote to memory of 2688 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 2604 wrote to memory of 2688 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 2604 wrote to memory of 2688 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 2604 wrote to memory of 2688 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 2604 wrote to memory of 2688 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe PID 2604 wrote to memory of 2688 2604 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe 5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe"C:\Users\Admin\AppData\Local\Temp\5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NocFvzQwuCyer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NocFvzQwuCyer" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5DE8.tmp"2⤵
- Creates scheduled task(s)
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe"C:\Users\Admin\AppData\Local\Temp\5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JNryQsBc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA1FA.tmp"3⤵
- Creates scheduled task(s)
PID:1704 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JNryQsBc.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe"C:\Users\Admin\AppData\Local\Temp\5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe"3⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe"C:\Users\Admin\AppData\Local\Temp\5304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a0eaa00f60d14677dbae5b4ec4c2aab5
SHA1a2db4a4dc0630a721fcee961060191859718ec2c
SHA2567a9e63e82e5f27dbba808796485c0791765f5b6804472209f8c03a94c26a8403
SHA5129278cd7074cba319c7306a41588662eff884c83d1c112cbc3d4a9ba117ad343689625347132b370a71b3821e46070433fedaf32e4109e56259530c296f953546
-
Filesize
1KB
MD5ad1503e9e48dbe69b5e81d2f3fb93754
SHA18ef8baa26f1a8cc4ad7c52a87ae60d4624c65e59
SHA256c9285ac6fb726fc086dcc69d8dc66d238406079f1cb4bcc3851848e731a10ced
SHA512f479c4ef8abc208f7de1cc5d044446458efd837014f9726297a491d7a1d800f60978fd7127790960991999b4da001d55b9f3ba0fa97548ae25210b1493bd7c5b
-
Filesize
1.0MB
MD5914b506cc02b0d32af5434361f70c288
SHA190954ee530a99352a521bcfc90daa7f440cecd47
SHA2565304e7af09e35bec2d33e150285158550be5adbeaa1fffd54cac34f6ff3fe5ec
SHA512392fa1b3e4d6c84aa23348db64ebaeaad0187e582eff4cd1eec69fc753cf448088de7276260c87f85b80170f1ee06ec41dc4c6e09251dddd0201530488a776cb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HLXBEDC78X044LF0EKXL.temp
Filesize7KB
MD5ccd4ee9824bd04f12e6144b16f2e0372
SHA19a572bf2dea1e5e6146f3db024c6ec920a3f29c8
SHA25606539054fd7a2181dcedb445493bf7f66b6c3dad009bd9a154a4349ef7a15b57
SHA512cfefbd5e99b245bdf64cfb9b306fbec3cdceaf1ad8e52d6ae5bbeda87937f8526c80e5d949ce8000acaacc977f4096bd773650b68c5e53dcd7ff86077acb449f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5ccd4ee9824bd04f12e6144b16f2e0372
SHA19a572bf2dea1e5e6146f3db024c6ec920a3f29c8
SHA25606539054fd7a2181dcedb445493bf7f66b6c3dad009bd9a154a4349ef7a15b57
SHA512cfefbd5e99b245bdf64cfb9b306fbec3cdceaf1ad8e52d6ae5bbeda87937f8526c80e5d949ce8000acaacc977f4096bd773650b68c5e53dcd7ff86077acb449f