Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
12-12-2023 02:18
Static task
static1
Behavioral task
behavioral1
Sample
b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe
Resource
win7-20231020-en
General
-
Target
b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe
-
Size
629KB
-
MD5
3de3b2aec3580c30d26038ae32e441d2
-
SHA1
dfc2501866a225f36d61fe0fcbce7ed288a442cb
-
SHA256
b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379
-
SHA512
56840bab4753d3c1ed380ee1092b3211fb2aeb723b964dbe2b046cd32b539a3d25b8becf39a117583d62415d6d57f55295a7f74d525aee0f553f535338ae22e1
-
SSDEEP
12288:w3IU8S6eUdUO2sMCqXHwJORW4iWEgH8CRRjZQ1TGvqbbZuGMkRiPPVFeh:OItSAdUOwMOk/WvjZQ1tZuGMEiPPVF
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.mailo.com - Port:
587 - Username:
[email protected] - Password:
Bignosa1995 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2112-3-0x0000000000500000-0x0000000000518000-memory.dmp family_zgrat_v1 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exedescription pid process target process PID 2112 set thread context of 2604 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exepowershell.exepowershell.exeb4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exepid process 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe 2812 powershell.exe 2856 powershell.exe 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe 2604 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe 2604 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exepowershell.exepowershell.exeb4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exedescription pid process Token: SeDebugPrivilege 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe Token: SeDebugPrivilege 2812 powershell.exe Token: SeDebugPrivilege 2856 powershell.exe Token: SeDebugPrivilege 2604 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exepid process 2604 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exedescription pid process target process PID 2112 wrote to memory of 2856 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe powershell.exe PID 2112 wrote to memory of 2856 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe powershell.exe PID 2112 wrote to memory of 2856 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe powershell.exe PID 2112 wrote to memory of 2856 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe powershell.exe PID 2112 wrote to memory of 2812 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe powershell.exe PID 2112 wrote to memory of 2812 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe powershell.exe PID 2112 wrote to memory of 2812 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe powershell.exe PID 2112 wrote to memory of 2812 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe powershell.exe PID 2112 wrote to memory of 2600 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe schtasks.exe PID 2112 wrote to memory of 2600 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe schtasks.exe PID 2112 wrote to memory of 2600 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe schtasks.exe PID 2112 wrote to memory of 2600 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe schtasks.exe PID 2112 wrote to memory of 2596 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe PID 2112 wrote to memory of 2596 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe PID 2112 wrote to memory of 2596 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe PID 2112 wrote to memory of 2596 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe PID 2112 wrote to memory of 2604 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe PID 2112 wrote to memory of 2604 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe PID 2112 wrote to memory of 2604 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe PID 2112 wrote to memory of 2604 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe PID 2112 wrote to memory of 2604 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe PID 2112 wrote to memory of 2604 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe PID 2112 wrote to memory of 2604 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe PID 2112 wrote to memory of 2604 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe PID 2112 wrote to memory of 2604 2112 b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe"C:\Users\Admin\AppData\Local\Temp\b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DYFnSoq.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2812 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DYFnSoq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp82E6.tmp"2⤵
- Creates scheduled task(s)
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe"C:\Users\Admin\AppData\Local\Temp\b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe"2⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe"C:\Users\Admin\AppData\Local\Temp\b4603870f2a94658bd915f7255062c0629fd8b756e96ad465871f9173a7a0379.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d19e4be8b9cf8d32ec290220512bea6b
SHA1b3f0a8effcdca61d575f8f32708f5a6ac3a2dfdd
SHA256e09e55737fdf0b3739a5833470e1015450d3431ffd4844a49fc273defa504798
SHA5126c5bc9a1346da063ab068d29cd2aafc4e4a1646ba11a5dc6a6a8fcb6ed2c9994ad75c60abeab2dba29b0672e322c4ba2973ba1436452fda604d7cf1b38a6561b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Q5ZSTQSEKWOPNC9344ND.temp
Filesize7KB
MD58e7a5d27eb0f990500173053ba3d00c8
SHA1f60fb3ac8308f89a4a545c4f3f879ac6f228d241
SHA256e9967f1cb45d028ad376d4f6270f18672ce941a26ce7ecf1f0d8c9379dc8a595
SHA512edd7f250476f209976c7852a3dff7fdf9a3428ad0292a19e7adc1f22339138c2ac0864b7fd195a057789193c4854c7d9dd13cab92801eb8a9dd24c368e90c465