Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
11-12-2023 10:18
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.22941.9792.exe
-
Size
614KB
-
MD5
c76751eb111c227d587f5aff012df2fc
-
SHA1
89069a18e42fc15da8d221893dbadef9715ce5c8
-
SHA256
3f479de77fd65ff82d89c44b941aedd81d9afe93093699e40ba82b02e058719a
-
SHA512
39b7642c99bace5f1a1577a58cdb702fb384dbabeff28e9044a373b4f1e4c8a05e672c52e4ac21d16503afec5ec2f6656506a73901d8233c620f3110be6d827e
-
SSDEEP
12288:z3IU8S6eUdSTThn7IDPAbXopeOBA2TiE20XpMaqzIH+YOL:DItSAduhI0bXoVwEIamDH
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.vrlogistic.com - Port:
587 - Username:
[email protected] - Password:
@dmin@123 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22941.9792.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22941.9792.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22941.9792.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uCxRFk.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uCxRFk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC18B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53009547ecc15450513b3b5285850bace
SHA1a38d946bf5640d61c5ea48bf7aeefffd33ed0e1d
SHA2569aec4b6e11fd1df082a93c296ed1c3fa63b429a5e717a029cf8dfc2a8e74a6b7
SHA512c6ae71f5ccbf6334e822931b795643369b6d4eee37c7485a9259d4309ee6c11b4f403b1aefc5d1a2d5ec10a5ba1fd06443334a909d43222cee5da218003c0e09
-
Filesize
7KB
MD54669ced7f20ef13ce0dcc619ebfddc15
SHA17c176cba93f79c473d1ac45f8ed7c362709d3e9a
SHA2564bb131e62b5f8b38d3f5693906e895d6ce9d8ce0a4bc2c66e18449c9fefa9354
SHA512866da4fc5f838cb7c1b01da249ef3469712754663f4f79818c4378587d335ef7ae4d09a0a377db164f0867013a7081290ae86a87fdfbafc5a9f548e9df8d1caa
-
Filesize
6.9MB
-
Filesize
264KB
-
Filesize
256KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
256KB
-
Filesize
32KB
-
Filesize
6.9MB
-
Filesize
496KB
-
Filesize
40KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
96KB
-
Filesize
640KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB