Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
12-12-2023 12:11
Static task
static1
Behavioral task
behavioral1
Sample
Order - 07876575.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
Order - 07876575.exe
Resource
win10v2004-20231127-en
General
-
Target
Order - 07876575.exe
-
Size
696KB
-
MD5
3c7a5fd2797f25dde0e89456cc02bc36
-
SHA1
6e5e7b59c6433edaa3de647101d3832c1e8195c8
-
SHA256
9cca6b74cfa89d8505f53fe46291c89ec13c4c43e87192a0d1ed58cdbf54f4e5
-
SHA512
3f35d016fa6841e6227867e29a2168836f1b8d1d28164fb738220d88e6af5ed1a2caa1cce738b429a5e14f7e19b93b8429076746a538f1c9e2536c5de1506095
-
SSDEEP
12288:DgxxXwWvMXikxdMfL7wMnDJvQskQigfRsnC5gv/KeCCCofZZZ1ZliEXjdl47/1WN:iEdavwMnlQHPgIC5gv/KeCCCofZZZ1ZY
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bezzleauto.com - Port:
587 - Username:
[email protected] - Password:
Tommyduru8118 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 35 IoCs
Processes:
resource yara_rule behavioral1/memory/2620-2-0x00000000041D0000-0x000000000427A000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-3-0x00000000049C0000-0x0000000004A00000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-4-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-5-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-9-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-7-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-11-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-13-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-17-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-15-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-19-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-21-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-23-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-25-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-27-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-31-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-29-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-35-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-33-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-37-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-39-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-43-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-45-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-41-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-53-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-57-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-55-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-51-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-49-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-47-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-59-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-61-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-63-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-65-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 behavioral1/memory/2620-67-0x00000000041D0000-0x0000000004273000-memory.dmp family_zgrat_v1 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Order - 07876575.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Run\xml = "C:\\Users\\Admin\\AppData\\Roaming\\xml.exe" Order - 07876575.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order - 07876575.exedescription pid process target process PID 2620 set thread context of 268 2620 Order - 07876575.exe Order - 07876575.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exepid process 2856 ipconfig.exe 524 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Order - 07876575.exepid process 268 Order - 07876575.exe 268 Order - 07876575.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order - 07876575.exeOrder - 07876575.exedescription pid process Token: SeDebugPrivilege 2620 Order - 07876575.exe Token: SeDebugPrivilege 268 Order - 07876575.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
Order - 07876575.execmd.execmd.exedescription pid process target process PID 2620 wrote to memory of 1584 2620 Order - 07876575.exe cmd.exe PID 2620 wrote to memory of 1584 2620 Order - 07876575.exe cmd.exe PID 2620 wrote to memory of 1584 2620 Order - 07876575.exe cmd.exe PID 2620 wrote to memory of 1584 2620 Order - 07876575.exe cmd.exe PID 1584 wrote to memory of 2856 1584 cmd.exe ipconfig.exe PID 1584 wrote to memory of 2856 1584 cmd.exe ipconfig.exe PID 1584 wrote to memory of 2856 1584 cmd.exe ipconfig.exe PID 1584 wrote to memory of 2856 1584 cmd.exe ipconfig.exe PID 2620 wrote to memory of 2268 2620 Order - 07876575.exe cmd.exe PID 2620 wrote to memory of 2268 2620 Order - 07876575.exe cmd.exe PID 2620 wrote to memory of 2268 2620 Order - 07876575.exe cmd.exe PID 2620 wrote to memory of 2268 2620 Order - 07876575.exe cmd.exe PID 2268 wrote to memory of 524 2268 cmd.exe ipconfig.exe PID 2268 wrote to memory of 524 2268 cmd.exe ipconfig.exe PID 2268 wrote to memory of 524 2268 cmd.exe ipconfig.exe PID 2268 wrote to memory of 524 2268 cmd.exe ipconfig.exe PID 2620 wrote to memory of 268 2620 Order - 07876575.exe Order - 07876575.exe PID 2620 wrote to memory of 268 2620 Order - 07876575.exe Order - 07876575.exe PID 2620 wrote to memory of 268 2620 Order - 07876575.exe Order - 07876575.exe PID 2620 wrote to memory of 268 2620 Order - 07876575.exe Order - 07876575.exe PID 2620 wrote to memory of 268 2620 Order - 07876575.exe Order - 07876575.exe PID 2620 wrote to memory of 268 2620 Order - 07876575.exe Order - 07876575.exe PID 2620 wrote to memory of 268 2620 Order - 07876575.exe Order - 07876575.exe PID 2620 wrote to memory of 268 2620 Order - 07876575.exe Order - 07876575.exe PID 2620 wrote to memory of 268 2620 Order - 07876575.exe Order - 07876575.exe PID 2620 wrote to memory of 268 2620 Order - 07876575.exe Order - 07876575.exe PID 2620 wrote to memory of 268 2620 Order - 07876575.exe Order - 07876575.exe PID 2620 wrote to memory of 268 2620 Order - 07876575.exe Order - 07876575.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order - 07876575.exe"C:\Users\Admin\AppData\Local\Temp\Order - 07876575.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release2⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /release3⤵
- Gathers network information
PID:2856 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew2⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew3⤵
- Gathers network information
PID:524 -
C:\Users\Admin\AppData\Local\Temp\Order - 07876575.exe"C:\Users\Admin\AppData\Local\Temp\Order - 07876575.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:268