Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
-
submitted
06-12-2023 08:15
General
-
Target
Order 4102672345.exe
-
Size
639KB
-
MD5
e00ea5e1e1b9b1f8a63cb79f7c870359
-
SHA1
dce9d736e1e7865b925a6e77977440528fc77579
-
SHA256
07463687693e68947b76ead68ae75f764649c80725f4914cde0eaf0d1c4644d7
-
SHA512
427de637a2676e021654b3932095299e6674802db562532802bdcfc1eb7747121ca6608c61b4e4e3388293ae10f8d43ebc6fc34ccd23cdd1caf457cc912ac609
-
SSDEEP
12288:g97QaueH5qXSFVWKmcLht4aNkWOJGx4gW8POHnUbVvaoL:g9ZqAUeht4OxekAUByo
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.vrlogistic.com - Port:
587 - Username:
[email protected] - Password:
@dmin@123 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order 4102672345.exe"C:\Users\Admin\AppData\Local\Temp\Order 4102672345.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Order 4102672345.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CombpHV.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CombpHV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6171.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e7ff102914157da323d65d48d65fc26e
SHA1209cee8cd2bfa3ed57aa034fd8ff32cd0dd5584e
SHA256478c52d43950e7575f1b17951aeacde6272735e0c98120dae5232216a4bef5af
SHA512871198b157eaa8ffa3168fbe44c6cfdf67a9d5d15d3ac67cbaf176bdb8b7f1d12340a8cada00126adacd8883c6c3a0fcda7966446f3c67b29b1c5ce959abb57a
-
Filesize
7KB
MD5f7867a058969d403c25488cae7077f4b
SHA1133e044f8268c9f2bcdef25547c1e02176af16b1
SHA2563a4b6b1f110a301a742672a59509ce3ea3d6aa6b87445eeb212b925a6cd0da25
SHA5127190703974461185d3ccd2ede81b0c4cd30cf5462eeedf99f2f2c97017628c14c198eab5db16fbe0acd62dca8a74f1ab6235a9e48d610a2dc7969aa57b47ff07
-
Filesize
7KB
MD5f7867a058969d403c25488cae7077f4b
SHA1133e044f8268c9f2bcdef25547c1e02176af16b1
SHA2563a4b6b1f110a301a742672a59509ce3ea3d6aa6b87445eeb212b925a6cd0da25
SHA5127190703974461185d3ccd2ede81b0c4cd30cf5462eeedf99f2f2c97017628c14c198eab5db16fbe0acd62dca8a74f1ab6235a9e48d610a2dc7969aa57b47ff07
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
656KB
-
Filesize
496KB
-
Filesize
6.9MB
-
Filesize
104KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB