Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 01:24
Static task
static1
Behavioral task
behavioral1
Sample
ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe
Resource
win10v2004-20240226-en
General
-
Target
ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe
-
Size
622KB
-
MD5
1e8ecb9d9a5327abd414a0195c523628
-
SHA1
358da33c9b8f0334a835ecb910e22359e718a7bc
-
SHA256
ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490
-
SHA512
7c7ece4b3c052a33994ed38a77e2b200b26c31232f258ff0f4f6166bb6d031c80e3052697b6645fd57e420827d5a9e54a8b4989ebf88c218cf00e27b471b6ed1
-
SSDEEP
12288:ra5WGDPMJfniGQaw9TPs39kSmeC2xeVyaEX3nXUD51rx:Z9/rjMPs3VK2xeVpEnkl1
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6510566783:AAEqx5Uod2gO5hHDZ1xznAnHyO5uFneWegY/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exedescription pid process target process PID 2872 set thread context of 2984 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exepowershell.exeed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exepid process 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe 2052 powershell.exe 2984 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe 2984 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exepowershell.exeed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exedescription pid process Token: SeDebugPrivilege 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe Token: SeDebugPrivilege 2052 powershell.exe Token: SeDebugPrivilege 2984 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exepid process 2984 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exedescription pid process target process PID 2872 wrote to memory of 2052 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe powershell.exe PID 2872 wrote to memory of 2052 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe powershell.exe PID 2872 wrote to memory of 2052 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe powershell.exe PID 2872 wrote to memory of 2052 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe powershell.exe PID 2872 wrote to memory of 2656 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe schtasks.exe PID 2872 wrote to memory of 2656 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe schtasks.exe PID 2872 wrote to memory of 2656 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe schtasks.exe PID 2872 wrote to memory of 2656 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe schtasks.exe PID 2872 wrote to memory of 2748 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe PID 2872 wrote to memory of 2748 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe PID 2872 wrote to memory of 2748 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe PID 2872 wrote to memory of 2748 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe PID 2872 wrote to memory of 2984 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe PID 2872 wrote to memory of 2984 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe PID 2872 wrote to memory of 2984 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe PID 2872 wrote to memory of 2984 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe PID 2872 wrote to memory of 2984 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe PID 2872 wrote to memory of 2984 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe PID 2872 wrote to memory of 2984 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe PID 2872 wrote to memory of 2984 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe PID 2872 wrote to memory of 2984 2872 ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe"C:\Users\Admin\AppData\Local\Temp\ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lUaPONLS.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lUaPONLS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp421F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe"C:\Users\Admin\AppData\Local\Temp\ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe"C:\Users\Admin\AppData\Local\Temp\ed23f75c269f80d52f41bed70deb30ad4429268db9792f770f6b609c03480490.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp421F.tmpFilesize
1KB
MD547da611057c5e0a3b5bb80c192d6f699
SHA168d4199949f31d2624456703ef8a1e7093fe1f9c
SHA25634d55e89f51078da201b3417f2ea6979816fd2ff4de58cba21e882ee59b10a6c
SHA51261dd44b15bdb0027812f0023cd56788f6e4994933234065b0f6f6e662ad62476593a6a5d8347c4772fbb2ed0c4f841ec772b764d6ecda3ef9831de304737f4c0
-
memory/2052-30-0x000000006EA40000-0x000000006EFEB000-memory.dmpFilesize
5.7MB
-
memory/2052-27-0x000000006EA40000-0x000000006EFEB000-memory.dmpFilesize
5.7MB
-
memory/2052-28-0x0000000001D40000-0x0000000001D80000-memory.dmpFilesize
256KB
-
memory/2052-29-0x000000006EA40000-0x000000006EFEB000-memory.dmpFilesize
5.7MB
-
memory/2052-26-0x0000000001D40000-0x0000000001D80000-memory.dmpFilesize
256KB
-
memory/2872-24-0x00000000745B0000-0x0000000074C9E000-memory.dmpFilesize
6.9MB
-
memory/2872-3-0x0000000000240000-0x0000000000252000-memory.dmpFilesize
72KB
-
memory/2872-0-0x0000000000B30000-0x0000000000BD0000-memory.dmpFilesize
640KB
-
memory/2872-2-0x0000000000360000-0x00000000003A0000-memory.dmpFilesize
256KB
-
memory/2872-4-0x00000000003E0000-0x00000000003EC000-memory.dmpFilesize
48KB
-
memory/2872-5-0x0000000005CB0000-0x0000000005D32000-memory.dmpFilesize
520KB
-
memory/2872-1-0x00000000745B0000-0x0000000074C9E000-memory.dmpFilesize
6.9MB
-
memory/2984-23-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2984-21-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2984-19-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2984-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2984-25-0x00000000745B0000-0x0000000074C9E000-memory.dmpFilesize
6.9MB
-
memory/2984-16-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2984-13-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2984-15-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2984-14-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2984-31-0x00000000745B0000-0x0000000074C9E000-memory.dmpFilesize
6.9MB