Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system -
submitted
12-12-2023 14:45
Static task
static1
Behavioral task
behavioral1
Sample
rPO(1437).exe
Resource
win7-20231201-en
General
-
Target
rPO(1437).exe
-
Size
618KB
-
MD5
41c91c8f3a9d75efccd89372ecff39db
-
SHA1
325e0b574a81dd05673b1087e8ee93110d5a505d
-
SHA256
4ce5396c87f3a1c529e9f482ef25383e8e9751b39b2c0461c6f64526549fa639
-
SHA512
d8b3fc60ebefa133a67eb27b46c532145190d27b26341ca4a203d2d4559d8160a6dafb178cde53a9d9cb68b63631fe097e704d897e87ee44be7328d2831d9c68
-
SSDEEP
12288:2Z3IU8S6eUdT3AhlizaWgPxyb5VywPmSASteQgsjyGDrID12EsYRsnnIKG:2RItSAdTZrVywIuryx1h
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.abi0expertise.com - Port:
587 - Username:
[email protected] - Password:
Najwa1949! - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2560-3-0x0000000000280000-0x0000000000298000-memory.dmp family_zgrat_v1 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
rPO(1437).exedescription pid process target process PID 2560 set thread context of 2608 2560 rPO(1437).exe rPO(1437).exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exerPO(1437).exepid process 2748 powershell.exe 2608 rPO(1437).exe 2608 rPO(1437).exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exerPO(1437).exedescription pid process Token: SeDebugPrivilege 2748 powershell.exe Token: SeDebugPrivilege 2608 rPO(1437).exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
rPO(1437).exedescription pid process target process PID 2560 wrote to memory of 2748 2560 rPO(1437).exe powershell.exe PID 2560 wrote to memory of 2748 2560 rPO(1437).exe powershell.exe PID 2560 wrote to memory of 2748 2560 rPO(1437).exe powershell.exe PID 2560 wrote to memory of 2748 2560 rPO(1437).exe powershell.exe PID 2560 wrote to memory of 2816 2560 rPO(1437).exe schtasks.exe PID 2560 wrote to memory of 2816 2560 rPO(1437).exe schtasks.exe PID 2560 wrote to memory of 2816 2560 rPO(1437).exe schtasks.exe PID 2560 wrote to memory of 2816 2560 rPO(1437).exe schtasks.exe PID 2560 wrote to memory of 2608 2560 rPO(1437).exe rPO(1437).exe PID 2560 wrote to memory of 2608 2560 rPO(1437).exe rPO(1437).exe PID 2560 wrote to memory of 2608 2560 rPO(1437).exe rPO(1437).exe PID 2560 wrote to memory of 2608 2560 rPO(1437).exe rPO(1437).exe PID 2560 wrote to memory of 2608 2560 rPO(1437).exe rPO(1437).exe PID 2560 wrote to memory of 2608 2560 rPO(1437).exe rPO(1437).exe PID 2560 wrote to memory of 2608 2560 rPO(1437).exe rPO(1437).exe PID 2560 wrote to memory of 2608 2560 rPO(1437).exe rPO(1437).exe PID 2560 wrote to memory of 2608 2560 rPO(1437).exe rPO(1437).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\rPO(1437).exe"C:\Users\Admin\AppData\Local\Temp\rPO(1437).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LTDKGtbYzHjDN.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LTDKGtbYzHjDN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4F29.tmp"2⤵
- Creates scheduled task(s)
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\rPO(1437).exe"C:\Users\Admin\AppData\Local\Temp\rPO(1437).exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5325a8dee3a23a8cf52455b6cfaaedefa
SHA1978aa61f46bb3b806e167247b3e0a0621edae3de
SHA2567fbf3aafabf7cc0ea52d5a79c61e3d8ff5e673eb6ba1b5cdd672787c4cfe54dc
SHA512cac4a700b1701d5b34fecf1ff80d28bd465978236b37b014ce5ec6f2d7225aaaf09220dcf5bdfb32907dd52af2b4e248ea0ffea17e361b90f9d02e4c8bf4efb2