Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
12-12-2023 10:19
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe
Resource
win10v2004-20231130-en
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe
-
Size
663KB
-
MD5
d0443f3c5cb3943f18763fa71cb29012
-
SHA1
c12f03b346efcb38d264f5d6a93a8717dfd991a6
-
SHA256
28f355f50396aa239cfac12652aa588c810f025bb4f40e220810bc7b737466ff
-
SHA512
b22637b08c2c88723744fd9db61103f6549f76aac19152b292d04ffbe8cb7db8f71e9624bacb56258b70db58af002c43d89455070d959a23dfe65270a352afd2
-
SSDEEP
12288:DrS+4WpAEgy+DnFoNYSfBQU9Uyk+yDNQQL85r5kxN8iyV2Yd+:npAELYSOUuykFK5r5KhyA
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
nne dimma080 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1180-3-0x0000000000610000-0x0000000000628000-memory.dmp family_zgrat_v1 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2688 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2688 powershell.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exedescription pid process target process PID 1180 wrote to memory of 2688 1180 SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe powershell.exe PID 1180 wrote to memory of 2688 1180 SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe powershell.exe PID 1180 wrote to memory of 2688 1180 SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe powershell.exe PID 1180 wrote to memory of 2688 1180 SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe powershell.exe PID 1180 wrote to memory of 2772 1180 SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe schtasks.exe PID 1180 wrote to memory of 2772 1180 SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe schtasks.exe PID 1180 wrote to memory of 2772 1180 SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe schtasks.exe PID 1180 wrote to memory of 2772 1180 SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe schtasks.exe PID 1180 wrote to memory of 2692 1180 SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe PID 1180 wrote to memory of 2692 1180 SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe PID 1180 wrote to memory of 2692 1180 SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe PID 1180 wrote to memory of 2692 1180 SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe PID 1180 wrote to memory of 2692 1180 SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe PID 1180 wrote to memory of 2692 1180 SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe PID 1180 wrote to memory of 2692 1180 SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe PID 1180 wrote to memory of 2692 1180 SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BUsRXkd.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BUsRXkd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9AB9.tmp"2⤵
- Creates scheduled task(s)
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.5345.12149.exe"2⤵PID:2692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD581206e3a36f95da14b7ade91a73319ab
SHA1c57c2842cf35d182d86bb81470180bd6d3e08556
SHA25666f39a66c7977b0e717052b4335e1002881b0e3eefaaf3053ccc79fc91670676
SHA512e6df086056a5f57218045fe7cef99494134003bc56bab6c0ba21d4227669cfad398fb77f84b2765701cba9d5b378c746aeb4e28af3a080035b9e07b099d739c0