Analysis
-
max time kernel
143s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
12-12-2023 14:35
Static task
static1
Behavioral task
behavioral1
Sample
PRE ALERT NOTICE.exe
Resource
win7-20231025-en
General
-
Target
PRE ALERT NOTICE.exe
-
Size
662KB
-
MD5
3cfb07a2465657d8928e675dedcd9978
-
SHA1
c5bd7e1f89fde69af56a8305e5fac685557da92e
-
SHA256
b5373781057e3cc3a3e2064f57942adc17f2a3905de6c1037332dfaede7a9cba
-
SHA512
77c6687b8c635e90b8c19c914d5873ee40a8105448dc96480a2a1c1fb7abcb201ad4cd0a0ae9768a696743a29b1e6d25aeed62dcc93d5d60fee858781326c88a
-
SSDEEP
12288:huGo+4WpAE9y7Rxkz2Uo6hYMRbG7TyQ8WyDv3WDWHUIpUsimxVR5dx6D78cPLC+:ppAEIxyo6hplGUWyrWDEUIpUOTKD
Malware Config
Extracted
Protocol: smtp- Host:
mail.2sautomobile.com - Port:
587 - Username:
[email protected] - Password:
Kenzi051008
Extracted
agenttesla
Protocol: smtp- Host:
mail.2sautomobile.com - Port:
587 - Username:
[email protected] - Password:
Kenzi051008 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3652-6-0x0000000005E30000-0x0000000005E48000-memory.dmp family_zgrat_v1 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PRE ALERT NOTICE.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\Control Panel\International\Geo\Nation PRE ALERT NOTICE.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PRE ALERT NOTICE.exedescription pid process target process PID 3652 set thread context of 4260 3652 PRE ALERT NOTICE.exe PRE ALERT NOTICE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exePRE ALERT NOTICE.exepid process 376 powershell.exe 376 powershell.exe 404 powershell.exe 404 powershell.exe 4260 PRE ALERT NOTICE.exe 4260 PRE ALERT NOTICE.exe 4260 PRE ALERT NOTICE.exe 404 powershell.exe 376 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exePRE ALERT NOTICE.exedescription pid process Token: SeDebugPrivilege 376 powershell.exe Token: SeDebugPrivilege 404 powershell.exe Token: SeDebugPrivilege 4260 PRE ALERT NOTICE.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
PRE ALERT NOTICE.exedescription pid process target process PID 3652 wrote to memory of 376 3652 PRE ALERT NOTICE.exe powershell.exe PID 3652 wrote to memory of 376 3652 PRE ALERT NOTICE.exe powershell.exe PID 3652 wrote to memory of 376 3652 PRE ALERT NOTICE.exe powershell.exe PID 3652 wrote to memory of 404 3652 PRE ALERT NOTICE.exe powershell.exe PID 3652 wrote to memory of 404 3652 PRE ALERT NOTICE.exe powershell.exe PID 3652 wrote to memory of 404 3652 PRE ALERT NOTICE.exe powershell.exe PID 3652 wrote to memory of 4572 3652 PRE ALERT NOTICE.exe schtasks.exe PID 3652 wrote to memory of 4572 3652 PRE ALERT NOTICE.exe schtasks.exe PID 3652 wrote to memory of 4572 3652 PRE ALERT NOTICE.exe schtasks.exe PID 3652 wrote to memory of 4260 3652 PRE ALERT NOTICE.exe PRE ALERT NOTICE.exe PID 3652 wrote to memory of 4260 3652 PRE ALERT NOTICE.exe PRE ALERT NOTICE.exe PID 3652 wrote to memory of 4260 3652 PRE ALERT NOTICE.exe PRE ALERT NOTICE.exe PID 3652 wrote to memory of 4260 3652 PRE ALERT NOTICE.exe PRE ALERT NOTICE.exe PID 3652 wrote to memory of 4260 3652 PRE ALERT NOTICE.exe PRE ALERT NOTICE.exe PID 3652 wrote to memory of 4260 3652 PRE ALERT NOTICE.exe PRE ALERT NOTICE.exe PID 3652 wrote to memory of 4260 3652 PRE ALERT NOTICE.exe PRE ALERT NOTICE.exe PID 3652 wrote to memory of 4260 3652 PRE ALERT NOTICE.exe PRE ALERT NOTICE.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PRE ALERT NOTICE.exe"C:\Users\Admin\AppData\Local\Temp\PRE ALERT NOTICE.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PRE ALERT NOTICE.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:376 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eKoCjhdl.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:404 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eKoCjhdl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE474.tmp"2⤵
- Creates scheduled task(s)
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\PRE ALERT NOTICE.exe"C:\Users\Admin\AppData\Local\Temp\PRE ALERT NOTICE.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD51502a52720bc95b67a36f142368c3dbf
SHA1e53d89f3a607effa88081bc9e74a4e76a349a82e
SHA256b90ced041f3e371a56bb1e97e08cdb766ddc11f0c83ea34b597e04b5226c07de
SHA512372fca69149659b601dd50d27981da45c869fc501b56a105714fa744a706101e052fba21e2a9d6593200ae35d955492ba7bd53b48971b89471d627837ebcef47
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD559b2a5f65785df1e3f8be4ec5dab8ba5
SHA1195d461cbce0e2d6c3d12e46b6955552f7dd041b
SHA25672488e7d08cdb506cb8ca9ec272f5f31ba11c289220f8f358ef82b5a44887fa4
SHA5124922d5ef2bf07ef2f4dfc263f50087d56a94d0e270fd18b34935b6fe1ab5fc062535de63ebc223663ba2285ae7264893e31425039f3ad90e5571b053902f8ef2