Overview
overview
10Static
static
10Samples 1/...cd.exe
windows7-x64
10Samples 1/...cd.exe
windows10-2004-x64
10Samples 1/...9f.exe
windows7-x64
10Samples 1/...9f.exe
windows10-2004-x64
7Samples 1/...95.exe
windows7-x64
10Samples 1/...95.exe
windows10-2004-x64
5Samples 1/...d2.exe
windows7-x64
10Samples 1/...d2.exe
windows10-2004-x64
10Samples 1/...6c.exe
windows7-x64
10Samples 1/...6c.exe
windows10-2004-x64
10Samples 1/...e8.exe
windows7-x64
10Samples 1/...e8.exe
windows10-2004-x64
10Samples 1/...4f.exe
windows7-x64
10Samples 1/...4f.exe
windows10-2004-x64
10Samples 1/...0a.exe
windows7-x64
7Samples 1/...0a.exe
windows10-2004-x64
7Samples 1/...a5.exe
windows7-x64
10Samples 1/...a5.exe
windows10-2004-x64
10Samples 1/...f4.exe
windows7-x64
10Samples 1/...f4.exe
windows10-2004-x64
10Samples 1/...c3.exe
windows7-x64
7Samples 1/...c3.exe
windows10-2004-x64
7Samples 1/...c7.exe
windows7-x64
10Samples 1/...c7.exe
windows10-2004-x64
10Samples 1/...26.exe
windows7-x64
10Samples 1/...26.exe
windows10-2004-x64
10Samples 1/...3a.exe
windows7-x64
1Samples 1/...3a.exe
windows10-2004-x64
1Samples 1/...91.exe
windows7-x64
10Samples 1/...91.exe
windows10-2004-x64
10Samples 2/...c4.exe
windows7-x64
10Samples 2/...c4.exe
windows10-2004-x64
10Analysis
-
max time kernel
142s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
07-01-2024 18:26
Static task
static1
Behavioral task
behavioral1
Sample
Samples 1/0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Samples 1/0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cd.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
Samples 1/0dc8b4659b84d8d9b96e544279da980b36301253912a043b5e48c9bd7bb6e09f.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Samples 1/0dc8b4659b84d8d9b96e544279da980b36301253912a043b5e48c9bd7bb6e09f.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
Samples 1/1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
Samples 1/1d21da7ca3f1105e0fba4c64281c4199a1d2788bf2fd5ed975529e7a7ea6d695.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
Samples 1/1f2a3d598734fe566de2054f3c73fd2245fc6023f0740bdbae88a076f508ebd2.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
Samples 1/1f2a3d598734fe566de2054f3c73fd2245fc6023f0740bdbae88a076f508ebd2.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
Samples 1/2a6e81706ec02af2afc1254ac19dcf89203bc0cefd6d6df5cf57cd9c70526c6c.exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
Samples 1/2a6e81706ec02af2afc1254ac19dcf89203bc0cefd6d6df5cf57cd9c70526c6c.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
Samples 1/2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
Samples 1/2bee29bac294615a9d1b613ba775972cda26781938e3ae3aa60ad9737f1fbde8.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
Samples 1/2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
Samples 1/2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
Samples 1/3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a.exe
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
Samples 1/3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
Samples 1/3c36a35096a0e4ad330d8ae5953d844db3af5d0fa1780782a6a1adf32550fda5.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
Samples 1/3c36a35096a0e4ad330d8ae5953d844db3af5d0fa1780782a6a1adf32550fda5.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral19
Sample
Samples 1/3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
Samples 1/3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
Samples 1/3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
Samples 1/3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
Samples 1/3f3c3378e66bb67a7d1c45784e1d297a086abfd7591268e65d90ad10bd12d1c7.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
Samples 1/3f3c3378e66bb67a7d1c45784e1d297a086abfd7591268e65d90ad10bd12d1c7.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral25
Sample
Samples 1/4de3272c8195c4473cfa3c3abaaf682c7975ee0dc02f555fb5ac8588dcf3af26.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
Samples 1/4de3272c8195c4473cfa3c3abaaf682c7975ee0dc02f555fb5ac8588dcf3af26.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
Samples 1/5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
Samples 1/5cc02305d7b5cb0675f2ac65422a115aa44d8f28e5a2b759470d17d6bf851a3a.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral29
Sample
Samples 1/5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91.exe
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
Samples 1/5e6e5fe247e96c09a7297b32c31880847a6827762b9afdbb7d7b46e3c0071a91.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
Samples 2/10f4e5b89953a29f22a64373ec33b585af9b406a18710fec96d3adab993cbcc4.exe
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
Samples 2/10f4e5b89953a29f22a64373ec33b585af9b406a18710fec96d3adab993cbcc4.exe
Resource
win10v2004-20231215-en
General
-
Target
Samples 1/3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe
-
Size
742KB
-
MD5
6a5599535b36e8f4c9b6ee93fbac5d7b
-
SHA1
ef2d05734be03c9daa29b18aff428204770ba57c
-
SHA256
3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4
-
SHA512
ea8a9ee60f3160c3b55c6b2b1527b74bd36bdf50ad63cbf74d4bc83b1b45010dfa7620d73482fc55bd7ff717b90726b14fe327828c69dbdf457795630f8a6e5e
-
SSDEEP
12288:NRFk2DLWEHmW2JnRLFlTj99JkI7oyCKYJQSUlO3RmJzY3Kk0J562LAcjgSx9ilp1:7CtFJj9cIxNuXo5zAfs9u/hH9H
Malware Config
Extracted
agenttesla
https://discord.com/api/webhooks/1169917901906653224/YjkyFWX_CawSIPQ02zeV3XExHGtDteoh-fLuvdqIFqL772Pb__cJUtnVv4DqDRhm0ks1
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 48 api.ipify.org 50 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exedescription pid process target process PID 3484 set thread context of 1824 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2604 1824 WerFault.exe 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exepid process 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 1824 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 1824 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exedescription pid process Token: SeDebugPrivilege 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe Token: SeDebugPrivilege 1824 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exedescription pid process target process PID 3484 wrote to memory of 1824 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe PID 3484 wrote to memory of 1824 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe PID 3484 wrote to memory of 1824 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe PID 3484 wrote to memory of 1824 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe PID 3484 wrote to memory of 1824 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe PID 3484 wrote to memory of 1824 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe PID 3484 wrote to memory of 1824 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe PID 3484 wrote to memory of 1824 3484 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe 3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Samples 1\3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe"C:\Users\Admin\AppData\Local\Temp\Samples 1\3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\Samples 1\3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe"C:\Users\Admin\AppData\Local\Temp\Samples 1\3c5720111b5562bdbcef0ac01a7d4fcf47ad75af43f84220129c0a1abb5e65f4.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1824 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 20923⤵
- Program crash
PID:2604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1824 -ip 18241⤵PID:2636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1824-16-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/1824-21-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/1824-20-0x0000000007130000-0x0000000007180000-memory.dmpFilesize
320KB
-
memory/1824-13-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1824-18-0x00000000017C0000-0x00000000017D0000-memory.dmpFilesize
64KB
-
memory/1824-17-0x0000000005C00000-0x0000000005C66000-memory.dmpFilesize
408KB
-
memory/3484-5-0x0000000005CB0000-0x0000000005CC0000-memory.dmpFilesize
64KB
-
memory/3484-6-0x0000000005CE0000-0x0000000005CEA000-memory.dmpFilesize
40KB
-
memory/3484-8-0x00000000070B0000-0x00000000070BA000-memory.dmpFilesize
40KB
-
memory/3484-9-0x0000000007730000-0x00000000077C2000-memory.dmpFilesize
584KB
-
memory/3484-10-0x0000000009DE0000-0x0000000009E7C000-memory.dmpFilesize
624KB
-
memory/3484-11-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/3484-12-0x0000000005CB0000-0x0000000005CC0000-memory.dmpFilesize
64KB
-
memory/3484-7-0x0000000007690000-0x000000000769E000-memory.dmpFilesize
56KB
-
memory/3484-19-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/3484-0-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/3484-4-0x0000000006550000-0x00000000068A4000-memory.dmpFilesize
3.3MB
-
memory/3484-3-0x0000000005A90000-0x0000000005B22000-memory.dmpFilesize
584KB
-
memory/3484-2-0x0000000005FA0000-0x0000000006544000-memory.dmpFilesize
5.6MB
-
memory/3484-1-0x0000000000F70000-0x0000000001030000-memory.dmpFilesize
768KB