Analysis
-
max time kernel
145s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
11-12-2023 00:40
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe
Resource
win10v2004-20231127-en
General
-
Target
SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe
-
Size
679KB
-
MD5
19813f0f242ef992e7bacfd1da018818
-
SHA1
2514e9d5b329a66a2246e9e077225b2b6011c7dc
-
SHA256
9f9871c67ea785d65921ea232a89ec9ae4ba1bb13dd01732b39aaf406d9544a0
-
SHA512
001d50fd9d31ce474baef345cd8544c5872e06c488f8e400a71c02f45758e5877ef00b527acfc7762c40c83c0dc54cae3a5789b8aa3af852da9105b0f778598a
-
SSDEEP
12288:m+BgOWP6iqpEmQepZ972xhC5TeSpG2PCzhGKbS+RsRFDmj77rxMa1sMFs0mL:LCkpEcQ8dGM1+2zid3M0W
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.asiaparadisehotel.com - Port:
587 - Username:
[email protected] - Password:
KTNL)LqQaA(8 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2032-3-0x00000000005A0000-0x00000000005B8000-memory.dmp family_zgrat_v1 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Run\ZVOHvI = "C:\\Users\\Admin\\AppData\\Roaming\\ZVOHvI\\ZVOHvI.exe" RegSvcs.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Trojan.MulDropNET.68.30928.exedescription pid process target process PID 2032 set thread context of 2676 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
SecuriteInfo.com.Trojan.MulDropNET.68.30928.exeRegSvcs.exepowershell.exepid process 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe 2676 RegSvcs.exe 2676 RegSvcs.exe 2868 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SecuriteInfo.com.Trojan.MulDropNET.68.30928.exeRegSvcs.exepowershell.exedescription pid process Token: SeDebugPrivilege 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe Token: SeDebugPrivilege 2676 RegSvcs.exe Token: SeDebugPrivilege 2868 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 2676 RegSvcs.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
SecuriteInfo.com.Trojan.MulDropNET.68.30928.exedescription pid process target process PID 2032 wrote to memory of 2868 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe powershell.exe PID 2032 wrote to memory of 2868 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe powershell.exe PID 2032 wrote to memory of 2868 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe powershell.exe PID 2032 wrote to memory of 2868 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe powershell.exe PID 2032 wrote to memory of 2628 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe schtasks.exe PID 2032 wrote to memory of 2628 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe schtasks.exe PID 2032 wrote to memory of 2628 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe schtasks.exe PID 2032 wrote to memory of 2628 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe schtasks.exe PID 2032 wrote to memory of 840 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 840 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 840 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 840 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 840 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 840 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 840 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2792 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2792 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2792 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2792 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2792 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2792 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2792 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2676 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2676 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2676 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2676 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2676 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2676 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2676 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2676 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2676 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2676 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2676 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe PID 2032 wrote to memory of 2676 2032 SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDropNET.68.30928.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cjohXAdKr.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cjohXAdKr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8095.tmp"2⤵
- Creates scheduled task(s)
PID:2628 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:840
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2792
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2676
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e72280b42aec5e4a1be2493212bc04ec
SHA1d06f066eddc8f85fbe5983b50c2b47d3348509c3
SHA2569730b9cb5416ccecd5537aa7fd89fb969d2daf111985d4ac3475f577509287de
SHA512fbc6a0d227b69e1004850924189ec6b2a6607c037447c02941b80595f385c6b978a84e6b2008da5fc214e6c0143e849ea76f742d22a388132cbea2d7d5cedf61