Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26-01-2024 13:45
General
-
Target
SecuriteInfo.com.W32.MSIL_Kryptik.IYD.gen.Eldorado.20371.19827.exe
-
Size
724KB
-
MD5
fb3a881fa28d196bcbd22d534e772bd0
-
SHA1
1aa77a83c10996d031532ec60a710d718cacb3e2
-
SHA256
dd00caf5d7f9bf6c5286c276edcbf1ab721a439345867a1b42a318b923c34314
-
SHA512
4f72a7b930f69dbf9ca0f19d1be1db9f3bba1e48197b79ab9bee01c67ca2bc2b7712956f8ae5d6e72cd147dde897cac6e17d8ffb971462806a4d7a6682b7c003
-
SSDEEP
12288:Y89ujjU3YRggy3cMnjNB10XZBzoTrgeJbKvcDkJntVOb6dNTPRtSK1SuXfKmsDW2:Y8AjjJRFys4NH03cTEeokDkJntVO4T
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.coperwire.com - Port:
587 - Username:
[email protected] - Password:
ogadiMMA1! - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.IYD.gen.Eldorado.20371.19827.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.IYD.gen.Eldorado.20371.19827.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.IYD.gen.Eldorado.20371.19827.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NwFdyRO.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NwFdyRO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8C29.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54453b482ee919697967823dba3ab68ab
SHA12f16ddbbae7544e69be43b09c34d8ce1831d4848
SHA25647630c45f0c4e4c05a24923fe311791514c9152841ce4b202c8488c73dbb2b66
SHA51220c21e3fd683612210bb4418eed4aadf8a094fbad89b58fc2fc3c04c845c93ebf000a1e8a88166e497a06b9ebd4ee74a9eae7e16747c6c80e1b1eccda16ce325
-
Filesize
7KB
MD5432040b3deb794e36585e83ef1974e2d
SHA19dc638dd5360668f1db61d8413114bd2c354e67a
SHA256af8d205f11dfb328893a7473b70613f0106439611fb7f9906310287ffb6aa80a
SHA512030b8b8e514136ccb860a6cb06c01444ca0a44e22d6facbfc3cde419f7a49f252f65f6654a7a4687c1ed543e691d81b5fb33d6118f1c214c1ec72f17ceb58a9f
-
Filesize
6.9MB
-
Filesize
32KB
-
Filesize
752KB
-
Filesize
48KB
-
Filesize
496KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
96KB
-
Filesize
6.9MB
-
Filesize
264KB
-
Filesize
4KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
264KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB