Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
12-12-2023 14:43
Static task
static1
Behavioral task
behavioral1
Sample
rPO(1437).exe
Resource
win7-20231023-en
General
-
Target
rPO(1437).exe
-
Size
618KB
-
MD5
41c91c8f3a9d75efccd89372ecff39db
-
SHA1
325e0b574a81dd05673b1087e8ee93110d5a505d
-
SHA256
4ce5396c87f3a1c529e9f482ef25383e8e9751b39b2c0461c6f64526549fa639
-
SHA512
d8b3fc60ebefa133a67eb27b46c532145190d27b26341ca4a203d2d4559d8160a6dafb178cde53a9d9cb68b63631fe097e704d897e87ee44be7328d2831d9c68
-
SSDEEP
12288:2Z3IU8S6eUdT3AhlizaWgPxyb5VywPmSASteQgsjyGDrID12EsYRsnnIKG:2RItSAdTZrVywIuryx1h
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.abi0expertise.com - Port:
587 - Username:
[email protected] - Password:
Najwa1949! - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1728-3-0x0000000000340000-0x0000000000358000-memory.dmp family_zgrat_v1 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
rPO(1437).exedescription pid process target process PID 1728 set thread context of 2336 1728 rPO(1437).exe rPO(1437).exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
rPO(1437).exepowershell.exepid process 2336 rPO(1437).exe 2336 rPO(1437).exe 2748 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rPO(1437).exepowershell.exedescription pid process Token: SeDebugPrivilege 2336 rPO(1437).exe Token: SeDebugPrivilege 2748 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
rPO(1437).exedescription pid process target process PID 1728 wrote to memory of 2748 1728 rPO(1437).exe powershell.exe PID 1728 wrote to memory of 2748 1728 rPO(1437).exe powershell.exe PID 1728 wrote to memory of 2748 1728 rPO(1437).exe powershell.exe PID 1728 wrote to memory of 2748 1728 rPO(1437).exe powershell.exe PID 1728 wrote to memory of 2712 1728 rPO(1437).exe schtasks.exe PID 1728 wrote to memory of 2712 1728 rPO(1437).exe schtasks.exe PID 1728 wrote to memory of 2712 1728 rPO(1437).exe schtasks.exe PID 1728 wrote to memory of 2712 1728 rPO(1437).exe schtasks.exe PID 1728 wrote to memory of 2336 1728 rPO(1437).exe rPO(1437).exe PID 1728 wrote to memory of 2336 1728 rPO(1437).exe rPO(1437).exe PID 1728 wrote to memory of 2336 1728 rPO(1437).exe rPO(1437).exe PID 1728 wrote to memory of 2336 1728 rPO(1437).exe rPO(1437).exe PID 1728 wrote to memory of 2336 1728 rPO(1437).exe rPO(1437).exe PID 1728 wrote to memory of 2336 1728 rPO(1437).exe rPO(1437).exe PID 1728 wrote to memory of 2336 1728 rPO(1437).exe rPO(1437).exe PID 1728 wrote to memory of 2336 1728 rPO(1437).exe rPO(1437).exe PID 1728 wrote to memory of 2336 1728 rPO(1437).exe rPO(1437).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\rPO(1437).exe"C:\Users\Admin\AppData\Local\Temp\rPO(1437).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LTDKGtbYzHjDN.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LTDKGtbYzHjDN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8601.tmp"2⤵
- Creates scheduled task(s)
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\rPO(1437).exe"C:\Users\Admin\AppData\Local\Temp\rPO(1437).exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2336
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58589bbc5176d6e565484072d90117be5
SHA1a423f5d74f9074e0e76932db90cda4c031a1ea56
SHA256accda9a763b3d416b2830a1d6e7ecd5d7bfef5e4220ce4276c860bf26598ca09
SHA51288a6801ccfcb5cd5a77ccae953f26d73d1d39e45d29b63b3724cba8146f0bd6da033c6930c583d493a969a4200787a8b14a9bdc2bd1ee40256369c21f98e0337