Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 02:38
Static task
static1
Behavioral task
behavioral1
Sample
kYyBuIFRcL6U7Fl.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
kYyBuIFRcL6U7Fl.exe
Resource
win10v2004-20240226-en
General
-
Target
kYyBuIFRcL6U7Fl.exe
-
Size
604KB
-
MD5
dc6c813e0b5c0adab63e8f6e47d3fb76
-
SHA1
c9979e87cf35d8563a16bf52ad762c04c89badc9
-
SHA256
3d6012eb13b5a891571ea2d7c7bf120b9c12d479e5cb2c6ffc7e515e14c46866
-
SHA512
c3e83b275c6aedbf56fe581b6e5f5b7f9ec33573c460eca63590a33326c08378dd7ea04b1d80807fdfc74738d432adb9b37892a0655aff8611d2e30f4d9f9ef3
-
SSDEEP
12288:z+E26ddIYd1x66+9GreDc4bRbOpPE6/5kqRQeB0QzauW2a5W:aOwO1mQreDc4lypPp+kQelzauWS
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
sg2plcpnl0128.prod.sin2.secureserver.net - Port:
587 - Username:
[email protected] - Password:
]EMe[F7b^j@[ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2640-26-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2640-28-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2640-36-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2640-39-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2640-41-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2640-48-0x0000000004AE0000-0x0000000004B20000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2640-26-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2640-28-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2640-36-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2640-39-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2640-41-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2640-48-0x0000000004AE0000-0x0000000004B20000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables packed with SmartAssembly 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1968-4-0x0000000000510000-0x000000000051C000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly -
Detects executables referencing Windows vault credential objects. Observed in infostealers 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2640-26-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2640-28-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2640-36-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2640-39-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2640-41-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2640-48-0x0000000004AE0000-0x0000000004B20000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2640-26-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2640-28-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2640-36-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2640-39-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2640-41-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2640-48-0x0000000004AE0000-0x0000000004B20000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2640-26-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2640-28-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2640-36-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2640-39-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2640-41-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2640-48-0x0000000004AE0000-0x0000000004B20000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2640-26-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2640-28-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2640-36-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2640-39-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2640-41-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2640-48-0x0000000004AE0000-0x0000000004B20000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
kYyBuIFRcL6U7Fl.exedescription pid process target process PID 1968 set thread context of 2640 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
kYyBuIFRcL6U7Fl.exepowershell.exepowershell.exeRegSvcs.exepid process 1968 kYyBuIFRcL6U7Fl.exe 1968 kYyBuIFRcL6U7Fl.exe 1968 kYyBuIFRcL6U7Fl.exe 2980 powershell.exe 2876 powershell.exe 1968 kYyBuIFRcL6U7Fl.exe 1968 kYyBuIFRcL6U7Fl.exe 2640 RegSvcs.exe 2640 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
kYyBuIFRcL6U7Fl.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1968 kYyBuIFRcL6U7Fl.exe Token: SeDebugPrivilege 2980 powershell.exe Token: SeDebugPrivilege 2876 powershell.exe Token: SeDebugPrivilege 2640 RegSvcs.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
kYyBuIFRcL6U7Fl.exedescription pid process target process PID 1968 wrote to memory of 2980 1968 kYyBuIFRcL6U7Fl.exe powershell.exe PID 1968 wrote to memory of 2980 1968 kYyBuIFRcL6U7Fl.exe powershell.exe PID 1968 wrote to memory of 2980 1968 kYyBuIFRcL6U7Fl.exe powershell.exe PID 1968 wrote to memory of 2980 1968 kYyBuIFRcL6U7Fl.exe powershell.exe PID 1968 wrote to memory of 2876 1968 kYyBuIFRcL6U7Fl.exe powershell.exe PID 1968 wrote to memory of 2876 1968 kYyBuIFRcL6U7Fl.exe powershell.exe PID 1968 wrote to memory of 2876 1968 kYyBuIFRcL6U7Fl.exe powershell.exe PID 1968 wrote to memory of 2876 1968 kYyBuIFRcL6U7Fl.exe powershell.exe PID 1968 wrote to memory of 2032 1968 kYyBuIFRcL6U7Fl.exe schtasks.exe PID 1968 wrote to memory of 2032 1968 kYyBuIFRcL6U7Fl.exe schtasks.exe PID 1968 wrote to memory of 2032 1968 kYyBuIFRcL6U7Fl.exe schtasks.exe PID 1968 wrote to memory of 2032 1968 kYyBuIFRcL6U7Fl.exe schtasks.exe PID 1968 wrote to memory of 2160 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe PID 1968 wrote to memory of 2160 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe PID 1968 wrote to memory of 2160 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe PID 1968 wrote to memory of 2160 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe PID 1968 wrote to memory of 2160 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe PID 1968 wrote to memory of 2160 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe PID 1968 wrote to memory of 2160 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe PID 1968 wrote to memory of 2640 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe PID 1968 wrote to memory of 2640 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe PID 1968 wrote to memory of 2640 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe PID 1968 wrote to memory of 2640 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe PID 1968 wrote to memory of 2640 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe PID 1968 wrote to memory of 2640 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe PID 1968 wrote to memory of 2640 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe PID 1968 wrote to memory of 2640 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe PID 1968 wrote to memory of 2640 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe PID 1968 wrote to memory of 2640 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe PID 1968 wrote to memory of 2640 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe PID 1968 wrote to memory of 2640 1968 kYyBuIFRcL6U7Fl.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\kYyBuIFRcL6U7Fl.exe"C:\Users\Admin\AppData\Local\Temp\kYyBuIFRcL6U7Fl.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\kYyBuIFRcL6U7Fl.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UoqhCzdpcgs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UoqhCzdpcgs" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD4EB.tmp"2⤵
- Creates scheduled task(s)
PID:2032 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2160
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD4EB.tmpFilesize
1KB
MD5d89ce23d862c7646c6006e2a29badaeb
SHA12f63e938440d3c48f1c89c53486dffbe11c8cef9
SHA2569a0602c6983d3566c70c469fee14574d1d579a60ba81dc5518d2c708757f96d1
SHA5125e737e84734f27b9fdfb1c25dab4a53b4091d96f8b1e919fe56963d8ef512ef8385484a400ee579b46b2123116bfd91cf0237631b74c26cd6c9403c20fdceb35
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD50ba3d7a45d259cda4736100b435387a7
SHA1ea64891465be239595cfb4ad008962ae08d33ed1
SHA256375383cf33e4ac5343105aaab038957bacfe453c0360545dcc7103f3afd7176f
SHA51283ec020fe650ddf51723815e7fb0ac0aafbb3cfce5c5fdfdd06921e9a81a31335ee21e13c0ebf1b9b493138d6652d3f3ff6cbfcc6cc6a51c484182bcddce06e5
-
memory/1968-42-0x0000000074D20000-0x000000007540E000-memory.dmpFilesize
6.9MB
-
memory/1968-1-0x0000000074D20000-0x000000007540E000-memory.dmpFilesize
6.9MB
-
memory/1968-2-0x00000000048D0000-0x0000000004910000-memory.dmpFilesize
256KB
-
memory/1968-3-0x0000000000500000-0x0000000000512000-memory.dmpFilesize
72KB
-
memory/1968-4-0x0000000000510000-0x000000000051C000-memory.dmpFilesize
48KB
-
memory/1968-5-0x0000000005290000-0x0000000005312000-memory.dmpFilesize
520KB
-
memory/1968-0-0x00000000008B0000-0x000000000094E000-memory.dmpFilesize
632KB
-
memory/2640-48-0x0000000004AE0000-0x0000000004B20000-memory.dmpFilesize
256KB
-
memory/2640-36-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2640-23-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2640-47-0x0000000074D20000-0x000000007540E000-memory.dmpFilesize
6.9MB
-
memory/2640-44-0x0000000004AE0000-0x0000000004B20000-memory.dmpFilesize
256KB
-
memory/2640-43-0x0000000074D20000-0x000000007540E000-memory.dmpFilesize
6.9MB
-
memory/2640-26-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2640-19-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2640-28-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2640-41-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2640-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2640-39-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2876-18-0x000000006E7F0000-0x000000006ED9B000-memory.dmpFilesize
5.7MB
-
memory/2876-37-0x00000000023A0000-0x00000000023E0000-memory.dmpFilesize
256KB
-
memory/2876-31-0x00000000023A0000-0x00000000023E0000-memory.dmpFilesize
256KB
-
memory/2876-27-0x000000006E7F0000-0x000000006ED9B000-memory.dmpFilesize
5.7MB
-
memory/2876-24-0x000000006E7F0000-0x000000006ED9B000-memory.dmpFilesize
5.7MB
-
memory/2876-46-0x000000006E7F0000-0x000000006ED9B000-memory.dmpFilesize
5.7MB
-
memory/2980-35-0x0000000002430000-0x0000000002470000-memory.dmpFilesize
256KB
-
memory/2980-33-0x0000000002430000-0x0000000002470000-memory.dmpFilesize
256KB
-
memory/2980-29-0x000000006E7F0000-0x000000006ED9B000-memory.dmpFilesize
5.7MB
-
memory/2980-45-0x000000006E7F0000-0x000000006ED9B000-memory.dmpFilesize
5.7MB
-
memory/2980-22-0x0000000002430000-0x0000000002470000-memory.dmpFilesize
256KB
-
memory/2980-20-0x000000006E7F0000-0x000000006ED9B000-memory.dmpFilesize
5.7MB