Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05-12-2023 08:54
Static task
static1
Behavioral task
behavioral1
Sample
required and measured value.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
required and measured value.exe
Resource
win10v2004-20231127-en
General
-
Target
required and measured value.exe
-
Size
1008KB
-
MD5
3521aff033bea60a6e8869378b9d068c
-
SHA1
9d84d60857b499e6c6c13d684e67f11f6d8ca31a
-
SHA256
502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3
-
SHA512
98f3c653b2a763ffa72aa0873f760e06221428066a2f8dc9fcf4c5ecc620684acbf572518057b6c9eac952587d14f033bc9648531cfb0e97f68be86588310e8b
-
SSDEEP
24576:Bqas+pJyCkF0ODvYHkAduLZgBGROSYOmT7Lmte9:wyJyCkF9VAd4ZgBG4SYOy7
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bezzleauto.com - Port:
587 - Username:
[email protected] - Password:
Kene123456789 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
required and measured value.exedescription pid process target process PID 2448 set thread context of 2704 2448 required and measured value.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exeRegSvcs.exepid process 2200 powershell.exe 2088 powershell.exe 2704 RegSvcs.exe 2704 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2200 powershell.exe Token: SeDebugPrivilege 2088 powershell.exe Token: SeDebugPrivilege 2704 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
required and measured value.exedescription pid process target process PID 2448 wrote to memory of 2200 2448 required and measured value.exe powershell.exe PID 2448 wrote to memory of 2200 2448 required and measured value.exe powershell.exe PID 2448 wrote to memory of 2200 2448 required and measured value.exe powershell.exe PID 2448 wrote to memory of 2200 2448 required and measured value.exe powershell.exe PID 2448 wrote to memory of 2088 2448 required and measured value.exe powershell.exe PID 2448 wrote to memory of 2088 2448 required and measured value.exe powershell.exe PID 2448 wrote to memory of 2088 2448 required and measured value.exe powershell.exe PID 2448 wrote to memory of 2088 2448 required and measured value.exe powershell.exe PID 2448 wrote to memory of 2584 2448 required and measured value.exe schtasks.exe PID 2448 wrote to memory of 2584 2448 required and measured value.exe schtasks.exe PID 2448 wrote to memory of 2584 2448 required and measured value.exe schtasks.exe PID 2448 wrote to memory of 2584 2448 required and measured value.exe schtasks.exe PID 2448 wrote to memory of 2704 2448 required and measured value.exe RegSvcs.exe PID 2448 wrote to memory of 2704 2448 required and measured value.exe RegSvcs.exe PID 2448 wrote to memory of 2704 2448 required and measured value.exe RegSvcs.exe PID 2448 wrote to memory of 2704 2448 required and measured value.exe RegSvcs.exe PID 2448 wrote to memory of 2704 2448 required and measured value.exe RegSvcs.exe PID 2448 wrote to memory of 2704 2448 required and measured value.exe RegSvcs.exe PID 2448 wrote to memory of 2704 2448 required and measured value.exe RegSvcs.exe PID 2448 wrote to memory of 2704 2448 required and measured value.exe RegSvcs.exe PID 2448 wrote to memory of 2704 2448 required and measured value.exe RegSvcs.exe PID 2448 wrote to memory of 2704 2448 required and measured value.exe RegSvcs.exe PID 2448 wrote to memory of 2704 2448 required and measured value.exe RegSvcs.exe PID 2448 wrote to memory of 2704 2448 required and measured value.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\required and measured value.exe"C:\Users\Admin\AppData\Local\Temp\required and measured value.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\required and measured value.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2200 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kVDWrSDRqNaAK.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2088 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kVDWrSDRqNaAK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5080.tmp"2⤵
- Creates scheduled task(s)
PID:2584 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f679a0b943879776aea3624a4beaf340
SHA13545c3cee6599ef624178f22d29654feae3f8def
SHA256c3796307c8c88f525b0bd739900d88e3c4843e0e3500ad0027d4c31f681b5cd9
SHA512c58eaa29836e3fb755a1e2557228804dfee81500768d9ed415bd501d5b2dd6b393bf61b55e918b0426eeb062185776d5214af9a2a7994ef3b81cabf6fbcbee86
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\E2WTVFO9UK6D9PEAUQUX.temp
Filesize7KB
MD534966c67e42fa8c630738619376dc521
SHA1a49bca36dd360fc83b1e7d50705e4a646750e960
SHA25654a1af9a21d2ea5dcb151a57592431803e67f050efb2b227d31d97e9c19d7ff6
SHA512a68728a8bbd2c282f8dcb412d2a3768cc08adc337ac5184e89261cb6a2fdf051d1cc9e615ea9e4630660a12c32d8adfdc5e0bd5d3433933b14d74f6d0f8cf17b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD534966c67e42fa8c630738619376dc521
SHA1a49bca36dd360fc83b1e7d50705e4a646750e960
SHA25654a1af9a21d2ea5dcb151a57592431803e67f050efb2b227d31d97e9c19d7ff6
SHA512a68728a8bbd2c282f8dcb412d2a3768cc08adc337ac5184e89261cb6a2fdf051d1cc9e615ea9e4630660a12c32d8adfdc5e0bd5d3433933b14d74f6d0f8cf17b