Analysis
-
max time kernel
125s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2023 13:25
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Inject4.59820.14009.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.Inject4.59820.14009.exe
Resource
win10v2004-20231130-en
General
-
Target
SecuriteInfo.com.Trojan.Inject4.59820.14009.exe
-
Size
565KB
-
MD5
e45e292ee1302005225b8ee245018cc8
-
SHA1
5dd2b9ee3d84b40e7d4aecc5cc068367729e88ea
-
SHA256
a212cb057ef247f50d13b60031f5ef2527f1d86c79628a7d3d8bc328cbe1ccf6
-
SHA512
a3d6cc6975682344ba35345a19df338ef753055ab3be22f6687c7a090846d980af98dcee76741134ddb82e09b2c48df9d11d1e66bfee6e10d710c146e679621b
-
SSDEEP
12288:h2AQaueH5q8IDUKiAhTM1cJ3lfi5EIKqi+6u4UXrcbyyEAo:h2EqxDXhTM+xlLIpiM4UQ9E
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.adityagroup.co - Port:
587 - Username:
[email protected] - Password:
Aditya!@#$%^ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SecuriteInfo.com.Trojan.Inject4.59820.14009.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.Trojan.Inject4.59820.14009.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 36 api.ipify.org 37 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Trojan.Inject4.59820.14009.exedescription pid process target process PID 4200 set thread context of 3860 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
SecuriteInfo.com.Trojan.Inject4.59820.14009.exepowershell.exepowershell.exeRegSvcs.exepid process 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe 628 powershell.exe 2796 powershell.exe 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe 628 powershell.exe 2796 powershell.exe 3860 RegSvcs.exe 3860 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
SecuriteInfo.com.Trojan.Inject4.59820.14009.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe Token: SeDebugPrivilege 2796 powershell.exe Token: SeDebugPrivilege 628 powershell.exe Token: SeDebugPrivilege 3860 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
SecuriteInfo.com.Trojan.Inject4.59820.14009.exedescription pid process target process PID 4200 wrote to memory of 2796 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe powershell.exe PID 4200 wrote to memory of 2796 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe powershell.exe PID 4200 wrote to memory of 2796 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe powershell.exe PID 4200 wrote to memory of 628 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe powershell.exe PID 4200 wrote to memory of 628 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe powershell.exe PID 4200 wrote to memory of 628 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe powershell.exe PID 4200 wrote to memory of 1856 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe schtasks.exe PID 4200 wrote to memory of 1856 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe schtasks.exe PID 4200 wrote to memory of 1856 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe schtasks.exe PID 4200 wrote to memory of 3860 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe RegSvcs.exe PID 4200 wrote to memory of 3860 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe RegSvcs.exe PID 4200 wrote to memory of 3860 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe RegSvcs.exe PID 4200 wrote to memory of 3860 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe RegSvcs.exe PID 4200 wrote to memory of 3860 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe RegSvcs.exe PID 4200 wrote to memory of 3860 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe RegSvcs.exe PID 4200 wrote to memory of 3860 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe RegSvcs.exe PID 4200 wrote to memory of 3860 4200 SecuriteInfo.com.Trojan.Inject4.59820.14009.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.59820.14009.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.59820.14009.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.59820.14009.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2796 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UZZTTFhFFwXETf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:628 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UZZTTFhFFwXETf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8D6B.tmp"2⤵
- Creates scheduled task(s)
PID:1856 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD5b45eb7cdbb2a970eba5f6d284bf12e46
SHA1250f5af7f0507d66cc2f3b1f4719141a2c23f816
SHA256cfb404bc2dcb389830ca520ea265a6e21ad64cba1e34069fd240420415879982
SHA51223c4d6dd1c6ca2800812f46a0360d97bed4396516eec568dc60b517e36f15ed301ea4ba033020012a4a361d9f10ba13d4a9bd61485b4fb53c7fc906c8dfe52b5
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD50d7c20838fd0fb40358174708e40fc30
SHA1fa65d5cece31dedc70f6d4c0816c0fe5296deb88
SHA256f70f66d7f44211445d08d040a6fc47171dde05d30465d21a5f05f8c51ad25b49
SHA512dbf0d5f3215fd07dc257f64d5d33895a04f5ac4414f77b585e248508f45ee1e4036e9ab5f64e103059d8ef05e7bbedd55e3bccafb5806dfcebf140aaa4cecc75