Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system -
submitted
06-12-2023 03:02
Static task
static1
Behavioral task
behavioral1
Sample
228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa.exe
Resource
win10v2004-20231130-en
General
-
Target
228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa.exe
-
Size
408KB
-
MD5
750362927420a2b4b15b9b3bf0b48d80
-
SHA1
92ed4dff52d92c931bfc68f9c1da260bc6836c92
-
SHA256
228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa
-
SHA512
27bb863bfc1c4e78bde41035365af698e91f3bb365c45727de397d777ff369cf60427b9f9ca78ed5b0f3a36c194114f252a52e4ca1d5cde6004b39e6ce6493fa
-
SSDEEP
6144:P8LxB0ipoXRl6686UvtuY89JWdPo92oo9hejx7qT4UJuROph4Hc2eCm1/rFb:xTBl668jvEJ2Po92hWIB5pZV1/rp
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE 2 IoCs
Processes:
szumauym.exeszumauym.exepid process 2212 szumauym.exe 2096 szumauym.exe -
Loads dropped DLL 3 IoCs
Processes:
228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa.exeszumauym.exepid process 2384 228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa.exe 2384 228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa.exe 2212 szumauym.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
szumauym.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 szumauym.exe Key opened \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 szumauym.exe Key opened \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 szumauym.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
szumauym.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Windows\CurrentVersion\Run\qLYhCbk = "C:\\Users\\Admin\\AppData\\Roaming\\qLYhCbk\\qLYhCbk.exe" szumauym.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
szumauym.exedescription pid process target process PID 2212 set thread context of 2096 2212 szumauym.exe szumauym.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
szumauym.exepid process 2096 szumauym.exe 2096 szumauym.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
szumauym.exepid process 2212 szumauym.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
szumauym.exedescription pid process Token: SeDebugPrivilege 2096 szumauym.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa.exeszumauym.exedescription pid process target process PID 2384 wrote to memory of 2212 2384 228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa.exe szumauym.exe PID 2384 wrote to memory of 2212 2384 228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa.exe szumauym.exe PID 2384 wrote to memory of 2212 2384 228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa.exe szumauym.exe PID 2384 wrote to memory of 2212 2384 228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa.exe szumauym.exe PID 2212 wrote to memory of 2096 2212 szumauym.exe szumauym.exe PID 2212 wrote to memory of 2096 2212 szumauym.exe szumauym.exe PID 2212 wrote to memory of 2096 2212 szumauym.exe szumauym.exe PID 2212 wrote to memory of 2096 2212 szumauym.exe szumauym.exe PID 2212 wrote to memory of 2096 2212 szumauym.exe szumauym.exe -
outlook_office_path 1 IoCs
Processes:
szumauym.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 szumauym.exe -
outlook_win_path 1 IoCs
Processes:
szumauym.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 szumauym.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa.exe"C:\Users\Admin\AppData\Local\Temp\228c3940e349070310b7f8bd531a1a594fc0a677fbeaab7709b54f45d0be81fa.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\szumauym.exe"C:\Users\Admin\AppData\Local\Temp\szumauym.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\szumauym.exe"C:\Users\Admin\AppData\Local\Temp\szumauym.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
337KB
MD523ba68e0a17bd2c37967ca14746b6d3c
SHA13ffa1ecf9c9ea5f01c72b4c2822bb865b03acabd
SHA256af59dda66e3cc307bf07550282ca68d4b6e8dd5ffd94292f2e4f273f0b20f2ee
SHA5124605f7cdbb818d8e422f085729f6e85a40ac9cec601e5efb55834b87460df144a692b954b85c4efafbf212cfefc24df06ffe20b42facc9bde0374054a477852d
-
Filesize
164KB
MD5c81e8878d918798ac66b721a230e418a
SHA1da61219ef31095a8d4d98f7e960a27d5f6c43f10
SHA25638252fcd96bf50bd5e18e5cec4c44f9467a47712b06a2cfc6168e21ef30606d0
SHA512aaaa4504daa5c1169da740c31b6ffdc55f1ba7b32eb9bc430554a7880f3944936bef24aab30e690cba7c993a3fdb1c4bb51ba0fc803b078d93afe64a84f5f906
-
Filesize
164KB
MD5c81e8878d918798ac66b721a230e418a
SHA1da61219ef31095a8d4d98f7e960a27d5f6c43f10
SHA25638252fcd96bf50bd5e18e5cec4c44f9467a47712b06a2cfc6168e21ef30606d0
SHA512aaaa4504daa5c1169da740c31b6ffdc55f1ba7b32eb9bc430554a7880f3944936bef24aab30e690cba7c993a3fdb1c4bb51ba0fc803b078d93afe64a84f5f906
-
Filesize
164KB
MD5c81e8878d918798ac66b721a230e418a
SHA1da61219ef31095a8d4d98f7e960a27d5f6c43f10
SHA25638252fcd96bf50bd5e18e5cec4c44f9467a47712b06a2cfc6168e21ef30606d0
SHA512aaaa4504daa5c1169da740c31b6ffdc55f1ba7b32eb9bc430554a7880f3944936bef24aab30e690cba7c993a3fdb1c4bb51ba0fc803b078d93afe64a84f5f906
-
Filesize
164KB
MD5c81e8878d918798ac66b721a230e418a
SHA1da61219ef31095a8d4d98f7e960a27d5f6c43f10
SHA25638252fcd96bf50bd5e18e5cec4c44f9467a47712b06a2cfc6168e21ef30606d0
SHA512aaaa4504daa5c1169da740c31b6ffdc55f1ba7b32eb9bc430554a7880f3944936bef24aab30e690cba7c993a3fdb1c4bb51ba0fc803b078d93afe64a84f5f906
-
Filesize
164KB
MD5c81e8878d918798ac66b721a230e418a
SHA1da61219ef31095a8d4d98f7e960a27d5f6c43f10
SHA25638252fcd96bf50bd5e18e5cec4c44f9467a47712b06a2cfc6168e21ef30606d0
SHA512aaaa4504daa5c1169da740c31b6ffdc55f1ba7b32eb9bc430554a7880f3944936bef24aab30e690cba7c993a3fdb1c4bb51ba0fc803b078d93afe64a84f5f906
-
Filesize
164KB
MD5c81e8878d918798ac66b721a230e418a
SHA1da61219ef31095a8d4d98f7e960a27d5f6c43f10
SHA25638252fcd96bf50bd5e18e5cec4c44f9467a47712b06a2cfc6168e21ef30606d0
SHA512aaaa4504daa5c1169da740c31b6ffdc55f1ba7b32eb9bc430554a7880f3944936bef24aab30e690cba7c993a3fdb1c4bb51ba0fc803b078d93afe64a84f5f906
-
Filesize
164KB
MD5c81e8878d918798ac66b721a230e418a
SHA1da61219ef31095a8d4d98f7e960a27d5f6c43f10
SHA25638252fcd96bf50bd5e18e5cec4c44f9467a47712b06a2cfc6168e21ef30606d0
SHA512aaaa4504daa5c1169da740c31b6ffdc55f1ba7b32eb9bc430554a7880f3944936bef24aab30e690cba7c993a3fdb1c4bb51ba0fc803b078d93afe64a84f5f906