Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 01:13
Static task
static1
Behavioral task
behavioral1
Sample
NewOrder4567.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
NewOrder4567.exe
Resource
win10v2004-20240226-en
General
-
Target
NewOrder4567.exe
-
Size
729KB
-
MD5
334706ee1809fb91b773e31a83421a6f
-
SHA1
5d9ce7cbfaf669f201cefec925abcfe74b279eed
-
SHA256
fd675370ab1863be41ca596f88338c578f0c1f46cef5ae8765daee64d6409b09
-
SHA512
77bf82f117111067d3dae4a850b2c3dfbd656e15bf6292281f7a0d14b7b70bcbec9a80407ac4f68fcef7959f46914c5c9f5193029fdea69df044fb0f1240e17f
-
SSDEEP
12288:WC8yBa5WRiGJOK4MofpbohrUnEc3dX5R3eI0/gp00TRZEUxC0riPCkR:5pzRWbNpbodyr79tTAx
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.denvaco.info - Port:
587 - Username:
[email protected] - Password:
vwta.M,AH}Gq - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NewOrder4567.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\ZzNnoD = "C:\\Users\\Admin\\AppData\\Roaming\\ZzNnoD\\ZzNnoD.exe" NewOrder4567.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 api.ipify.org 3 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NewOrder4567.exedescription pid process target process PID 1784 set thread context of 2548 1784 NewOrder4567.exe NewOrder4567.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
NewOrder4567.exeNewOrder4567.exepowershell.exepowershell.exepid process 1784 NewOrder4567.exe 1784 NewOrder4567.exe 2548 NewOrder4567.exe 2548 NewOrder4567.exe 2004 powershell.exe 2612 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
NewOrder4567.exeNewOrder4567.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1784 NewOrder4567.exe Token: SeDebugPrivilege 2548 NewOrder4567.exe Token: SeDebugPrivilege 2004 powershell.exe Token: SeDebugPrivilege 2612 powershell.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
NewOrder4567.exedescription pid process target process PID 1784 wrote to memory of 2004 1784 NewOrder4567.exe powershell.exe PID 1784 wrote to memory of 2004 1784 NewOrder4567.exe powershell.exe PID 1784 wrote to memory of 2004 1784 NewOrder4567.exe powershell.exe PID 1784 wrote to memory of 2004 1784 NewOrder4567.exe powershell.exe PID 1784 wrote to memory of 2612 1784 NewOrder4567.exe powershell.exe PID 1784 wrote to memory of 2612 1784 NewOrder4567.exe powershell.exe PID 1784 wrote to memory of 2612 1784 NewOrder4567.exe powershell.exe PID 1784 wrote to memory of 2612 1784 NewOrder4567.exe powershell.exe PID 1784 wrote to memory of 2828 1784 NewOrder4567.exe schtasks.exe PID 1784 wrote to memory of 2828 1784 NewOrder4567.exe schtasks.exe PID 1784 wrote to memory of 2828 1784 NewOrder4567.exe schtasks.exe PID 1784 wrote to memory of 2828 1784 NewOrder4567.exe schtasks.exe PID 1784 wrote to memory of 2548 1784 NewOrder4567.exe NewOrder4567.exe PID 1784 wrote to memory of 2548 1784 NewOrder4567.exe NewOrder4567.exe PID 1784 wrote to memory of 2548 1784 NewOrder4567.exe NewOrder4567.exe PID 1784 wrote to memory of 2548 1784 NewOrder4567.exe NewOrder4567.exe PID 1784 wrote to memory of 2548 1784 NewOrder4567.exe NewOrder4567.exe PID 1784 wrote to memory of 2548 1784 NewOrder4567.exe NewOrder4567.exe PID 1784 wrote to memory of 2548 1784 NewOrder4567.exe NewOrder4567.exe PID 1784 wrote to memory of 2548 1784 NewOrder4567.exe NewOrder4567.exe PID 1784 wrote to memory of 2548 1784 NewOrder4567.exe NewOrder4567.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NewOrder4567.exe"C:\Users\Admin\AppData\Local\Temp\NewOrder4567.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\NewOrder4567.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fGAKDz.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fGAKDz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp67D7.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\NewOrder4567.exe"C:\Users\Admin\AppData\Local\Temp\NewOrder4567.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp67D7.tmpFilesize
1KB
MD52e8b84f34cdbabd9686e88251bcaa182
SHA1651e5730eb2db2f0524521833fb1b9283fdbd859
SHA2560086f01cf7f92cda8ec935bc041af6b694e4a83d4667117e58de0e97de2eefc6
SHA512088686c3b5aa34b706f540bedd8b9b89baf4510a1317f364f5e8e25c741d0f1e5a3be516efb318ff95110e03779296dd50bf2e072087b8dfed3e4b1015c86f24
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD56a0a7f932fcd40608988170c39fce80f
SHA115e48af3123a1e6f6efc7add80f833d6ce3dd260
SHA256bc444f8abd8655adeb269c918098b35833e1f5a560b76525a174b0f7534b8a2d
SHA512af2a8115e89d0c3a62fa0cc6cec20ac17c62de84a4f3855e0cacb1fc84ee033564842a5ca5f389d687b222e3312a78080b1c2de0506e92a498afe1de7d77ecc4
-
memory/1784-31-0x0000000074220000-0x000000007490E000-memory.dmpFilesize
6.9MB
-
memory/1784-1-0x0000000074220000-0x000000007490E000-memory.dmpFilesize
6.9MB
-
memory/1784-2-0x00000000003C0000-0x0000000000400000-memory.dmpFilesize
256KB
-
memory/1784-3-0x0000000000350000-0x0000000000362000-memory.dmpFilesize
72KB
-
memory/1784-4-0x00000000003B0000-0x00000000003BC000-memory.dmpFilesize
48KB
-
memory/1784-5-0x0000000005340000-0x00000000053C4000-memory.dmpFilesize
528KB
-
memory/1784-0-0x0000000000C30000-0x0000000000CE8000-memory.dmpFilesize
736KB
-
memory/2004-36-0x000000006E800000-0x000000006EDAB000-memory.dmpFilesize
5.7MB
-
memory/2004-32-0x000000006E800000-0x000000006EDAB000-memory.dmpFilesize
5.7MB
-
memory/2004-41-0x000000006E800000-0x000000006EDAB000-memory.dmpFilesize
5.7MB
-
memory/2004-34-0x0000000002750000-0x0000000002790000-memory.dmpFilesize
256KB
-
memory/2548-40-0x0000000074220000-0x000000007490E000-memory.dmpFilesize
6.9MB
-
memory/2548-22-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2548-30-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2548-26-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2548-20-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2548-28-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2548-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2548-45-0x0000000074220000-0x000000007490E000-memory.dmpFilesize
6.9MB
-
memory/2548-18-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2548-44-0x0000000004B30000-0x0000000004B70000-memory.dmpFilesize
256KB
-
memory/2548-23-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2548-38-0x0000000004B30000-0x0000000004B70000-memory.dmpFilesize
256KB
-
memory/2612-33-0x000000006E800000-0x000000006EDAB000-memory.dmpFilesize
5.7MB
-
memory/2612-39-0x0000000002550000-0x0000000002590000-memory.dmpFilesize
256KB
-
memory/2612-42-0x000000006E800000-0x000000006EDAB000-memory.dmpFilesize
5.7MB
-
memory/2612-37-0x0000000002550000-0x0000000002590000-memory.dmpFilesize
256KB
-
memory/2612-35-0x000000006E800000-0x000000006EDAB000-memory.dmpFilesize
5.7MB