Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/02/2024, 05:06
Static task
static1
Behavioral task
behavioral1
Sample
4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe
Resource
win10v2004-20240221-en
General
-
Target
4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe
-
Size
704KB
-
MD5
f83c7fd6121ed30a1f11a6496ac24537
-
SHA1
29c827c2f2a7618c7f44d6f08db8df338b90f069
-
SHA256
4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0
-
SHA512
e3c6b7169f0dd035afa63c38075aa28db13751cd8ee39758156703c0ff137b10ce40480e4952ddb1186ed6088e1d07893656818219d8d02390323afb83e92818
-
SSDEEP
12288:7ws/jiK5Ujd53LlvqAg4i9yoXCdyZ/+k+FbvPDaNHjAnBRl9VuQBBtFDgYRoTMpr:hiGK5g4i9yaQC+kw32HmBr3BtF9RoTMh
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.2sautomobile.com - Port:
587 - Username:
[email protected] - Password:
Kenzi051008 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
resource yara_rule behavioral2/memory/2052-37-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
resource yara_rule behavioral2/memory/2052-37-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
resource yara_rule behavioral2/memory/2052-37-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL -
Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
resource yara_rule behavioral2/memory/2052-37-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
resource yara_rule behavioral2/memory/2052-37-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
resource yara_rule behavioral2/memory/2052-37-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
resource yara_rule behavioral2/memory/2052-37-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000\Control Panel\International\Geo\Nation 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HroxB = "C:\\Users\\Admin\\AppData\\Roaming\\HroxB\\HroxB.exe" RegSvcs.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 30 api.ipify.org 31 api.ipify.org 32 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3196 set thread context of 2052 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 99 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2064 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 3788 powershell.exe 2900 powershell.exe 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 2052 RegSvcs.exe 2052 RegSvcs.exe 3788 powershell.exe 2900 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe Token: SeDebugPrivilege 3788 powershell.exe Token: SeDebugPrivilege 2900 powershell.exe Token: SeDebugPrivilege 2052 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3196 wrote to memory of 3788 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 93 PID 3196 wrote to memory of 3788 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 93 PID 3196 wrote to memory of 3788 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 93 PID 3196 wrote to memory of 2900 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 95 PID 3196 wrote to memory of 2900 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 95 PID 3196 wrote to memory of 2900 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 95 PID 3196 wrote to memory of 2064 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 97 PID 3196 wrote to memory of 2064 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 97 PID 3196 wrote to memory of 2064 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 97 PID 3196 wrote to memory of 2052 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 99 PID 3196 wrote to memory of 2052 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 99 PID 3196 wrote to memory of 2052 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 99 PID 3196 wrote to memory of 2052 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 99 PID 3196 wrote to memory of 2052 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 99 PID 3196 wrote to memory of 2052 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 99 PID 3196 wrote to memory of 2052 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 99 PID 3196 wrote to memory of 2052 3196 4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe"C:\Users\Admin\AppData\Local\Temp\4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4c17e4d9c3a7736be5e5ee6bb8c414e9a66a397fb81e3185b5d2360a84a084f0.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3788
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cNCUzJcGthrLa.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cNCUzJcGthrLa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp74B3.tmp"2⤵
- Creates scheduled task(s)
PID:2064
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD539d5fb75a1a88733c93fed469d302c6c
SHA1ccb48c627c802e6b521722f07e5294b203a0c14c
SHA2567a99e5b921ea8d35008aab71174c63bf40641ecb84e98b90d0bd2ae42fb0e0a8
SHA5124dc1060a5dab1fb342464c7f01b5b383d99da8eb89873c71816c805550cb097b8ecd279817b72ab6b4f5acb63575b4cff2cb1fae5b4f68dbd738b93c8d582a7d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD54f1b4f195dd1d42a5ab6945bfd8a3fc1
SHA144cf9f5cd139b1e5db5ea042f23b8ae49b642bb2
SHA2564dd66a28da1a9a5034dcb04a15210dedbc639f216109e838b006657ae7076f30
SHA51282f0d01f406cb611bfcbb46533f8efd95a68a86de5c284b2b68b9924ce126c0fdfd0166259c7bb4a82ffb20a0071f26c90ade57f13fe9547e0e67bc4f5ad9398