Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system -
submitted
05-12-2023 16:43
Static task
static1
Behavioral task
behavioral1
Sample
d4023d971af3eda8dddfc41493d49f3cc47748ad20cdcf602bf19f88c39e06f4.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
d4023d971af3eda8dddfc41493d49f3cc47748ad20cdcf602bf19f88c39e06f4.exe
Resource
win10v2004-20231130-en
General
-
Target
d4023d971af3eda8dddfc41493d49f3cc47748ad20cdcf602bf19f88c39e06f4.exe
-
Size
509KB
-
MD5
2c013b3be5e26e53cace27abe1d9803b
-
SHA1
f5c217e1a7bf046e0e1c0efed58345725795e57d
-
SHA256
d4023d971af3eda8dddfc41493d49f3cc47748ad20cdcf602bf19f88c39e06f4
-
SHA512
c2c5349e383f03827c90f7590f9e3f97a566a294b705bb39ab8c64d34c8780b01a791307f250c63252026fe68586f1409915959308b4c92bfb20484b0452784e
-
SSDEEP
12288:wrs6p8UdGrUOUitLuWbmjV7AVUZGclZI8w0bfDudz:SsedGr/Ui1uTjVqUQclLbSl
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE 2 IoCs
Processes:
omkjnbxkb.exeomkjnbxkb.exepid process 1780 omkjnbxkb.exe 2436 omkjnbxkb.exe -
Loads dropped DLL 3 IoCs
Processes:
d4023d971af3eda8dddfc41493d49f3cc47748ad20cdcf602bf19f88c39e06f4.exeomkjnbxkb.exepid process 3040 d4023d971af3eda8dddfc41493d49f3cc47748ad20cdcf602bf19f88c39e06f4.exe 3040 d4023d971af3eda8dddfc41493d49f3cc47748ad20cdcf602bf19f88c39e06f4.exe 1780 omkjnbxkb.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
omkjnbxkb.exedescription pid process target process PID 1780 set thread context of 2436 1780 omkjnbxkb.exe omkjnbxkb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
omkjnbxkb.exepid process 2436 omkjnbxkb.exe 2436 omkjnbxkb.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
omkjnbxkb.exepid process 1780 omkjnbxkb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
omkjnbxkb.exedescription pid process Token: SeDebugPrivilege 2436 omkjnbxkb.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
omkjnbxkb.exepid process 2436 omkjnbxkb.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
d4023d971af3eda8dddfc41493d49f3cc47748ad20cdcf602bf19f88c39e06f4.exeomkjnbxkb.exedescription pid process target process PID 3040 wrote to memory of 1780 3040 d4023d971af3eda8dddfc41493d49f3cc47748ad20cdcf602bf19f88c39e06f4.exe omkjnbxkb.exe PID 3040 wrote to memory of 1780 3040 d4023d971af3eda8dddfc41493d49f3cc47748ad20cdcf602bf19f88c39e06f4.exe omkjnbxkb.exe PID 3040 wrote to memory of 1780 3040 d4023d971af3eda8dddfc41493d49f3cc47748ad20cdcf602bf19f88c39e06f4.exe omkjnbxkb.exe PID 3040 wrote to memory of 1780 3040 d4023d971af3eda8dddfc41493d49f3cc47748ad20cdcf602bf19f88c39e06f4.exe omkjnbxkb.exe PID 1780 wrote to memory of 2436 1780 omkjnbxkb.exe omkjnbxkb.exe PID 1780 wrote to memory of 2436 1780 omkjnbxkb.exe omkjnbxkb.exe PID 1780 wrote to memory of 2436 1780 omkjnbxkb.exe omkjnbxkb.exe PID 1780 wrote to memory of 2436 1780 omkjnbxkb.exe omkjnbxkb.exe PID 1780 wrote to memory of 2436 1780 omkjnbxkb.exe omkjnbxkb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4023d971af3eda8dddfc41493d49f3cc47748ad20cdcf602bf19f88c39e06f4.exe"C:\Users\Admin\AppData\Local\Temp\d4023d971af3eda8dddfc41493d49f3cc47748ad20cdcf602bf19f88c39e06f4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\omkjnbxkb.exe"C:\Users\Admin\AppData\Local\Temp\omkjnbxkb.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\omkjnbxkb.exe"C:\Users\Admin\AppData\Local\Temp\omkjnbxkb.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
333KB
MD5e44be8ba29bd4b39159bca2feadae8af
SHA11c1d829c0be8b41ec19a068b07551a9f7961d3f7
SHA256939e4417955a6b7a0aec691d28e907b2e05e08632de176d34cd6a8ca30e299c9
SHA512569a0f8fab91a673ffabc425061d38365fcca515671d6c8a6a1307b2e170da38bebc258651671d97b2b6d83e7a57868de8810caac77f79b2f61af036b886901c
-
Filesize
287KB
MD5337dcbd6bf024a6ab5ac8983e4b839f6
SHA10582e3ed802ee37d8c76517317025bf2d393d204
SHA256c34a0bf8e49cd79a4635cc11dd43de1e5317393cb066146365c51e29e1cd04b3
SHA51213bb30789d8e70f4e1c0260510d76bdddb2ab2f98ca1816f2a3f6988edcda4586657937c4470c33385419189d193e3d47a5705d7df836f1b4964046d12dcb70f
-
Filesize
287KB
MD5337dcbd6bf024a6ab5ac8983e4b839f6
SHA10582e3ed802ee37d8c76517317025bf2d393d204
SHA256c34a0bf8e49cd79a4635cc11dd43de1e5317393cb066146365c51e29e1cd04b3
SHA51213bb30789d8e70f4e1c0260510d76bdddb2ab2f98ca1816f2a3f6988edcda4586657937c4470c33385419189d193e3d47a5705d7df836f1b4964046d12dcb70f
-
Filesize
287KB
MD5337dcbd6bf024a6ab5ac8983e4b839f6
SHA10582e3ed802ee37d8c76517317025bf2d393d204
SHA256c34a0bf8e49cd79a4635cc11dd43de1e5317393cb066146365c51e29e1cd04b3
SHA51213bb30789d8e70f4e1c0260510d76bdddb2ab2f98ca1816f2a3f6988edcda4586657937c4470c33385419189d193e3d47a5705d7df836f1b4964046d12dcb70f
-
Filesize
287KB
MD5337dcbd6bf024a6ab5ac8983e4b839f6
SHA10582e3ed802ee37d8c76517317025bf2d393d204
SHA256c34a0bf8e49cd79a4635cc11dd43de1e5317393cb066146365c51e29e1cd04b3
SHA51213bb30789d8e70f4e1c0260510d76bdddb2ab2f98ca1816f2a3f6988edcda4586657937c4470c33385419189d193e3d47a5705d7df836f1b4964046d12dcb70f
-
Filesize
287KB
MD5337dcbd6bf024a6ab5ac8983e4b839f6
SHA10582e3ed802ee37d8c76517317025bf2d393d204
SHA256c34a0bf8e49cd79a4635cc11dd43de1e5317393cb066146365c51e29e1cd04b3
SHA51213bb30789d8e70f4e1c0260510d76bdddb2ab2f98ca1816f2a3f6988edcda4586657937c4470c33385419189d193e3d47a5705d7df836f1b4964046d12dcb70f
-
Filesize
287KB
MD5337dcbd6bf024a6ab5ac8983e4b839f6
SHA10582e3ed802ee37d8c76517317025bf2d393d204
SHA256c34a0bf8e49cd79a4635cc11dd43de1e5317393cb066146365c51e29e1cd04b3
SHA51213bb30789d8e70f4e1c0260510d76bdddb2ab2f98ca1816f2a3f6988edcda4586657937c4470c33385419189d193e3d47a5705d7df836f1b4964046d12dcb70f
-
Filesize
287KB
MD5337dcbd6bf024a6ab5ac8983e4b839f6
SHA10582e3ed802ee37d8c76517317025bf2d393d204
SHA256c34a0bf8e49cd79a4635cc11dd43de1e5317393cb066146365c51e29e1cd04b3
SHA51213bb30789d8e70f4e1c0260510d76bdddb2ab2f98ca1816f2a3f6988edcda4586657937c4470c33385419189d193e3d47a5705d7df836f1b4964046d12dcb70f