Analysis
-
max time kernel
122s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 02:17
Static task
static1
Behavioral task
behavioral1
Sample
1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe
Resource
win10v2004-20240226-en
General
-
Target
1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe
-
Size
714KB
-
MD5
35dec616c5a8f0a6bca68bee80f613a6
-
SHA1
bc3c5900c9bb09215e8551239c29829f042de4c2
-
SHA256
1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845
-
SHA512
2def9f446ece08faf0728ed29e21377472232d7c8489bf759347af3a98b3796d808fd694a4e6621ba4d5beca7ff61ae41e973a278483b0bbae9f619958fe778b
-
SSDEEP
12288:8CLO1a5WMNFM/ecquaydMAi29cGTw3K4vr0WHvKHNzNJ5l:DLOvwsU768vkzb5
Malware Config
Extracted
Protocol: smtp- Host:
mail.scootero.cl - Port:
587 - Username:
[email protected] - Password:
Dangote1235$
Extracted
agenttesla
Protocol: smtp- Host:
mail.scootero.cl - Port:
587 - Username:
[email protected] - Password:
Dangote1235$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exedescription pid process target process PID 2652 set thread context of 2544 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exepowershell.exepid process 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe 2544 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe 2544 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe 2096 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exepowershell.exedescription pid process Token: SeDebugPrivilege 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe Token: SeDebugPrivilege 2544 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe Token: SeDebugPrivilege 2096 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exepid process 2544 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exedescription pid process target process PID 2652 wrote to memory of 2096 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe powershell.exe PID 2652 wrote to memory of 2096 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe powershell.exe PID 2652 wrote to memory of 2096 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe powershell.exe PID 2652 wrote to memory of 2096 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe powershell.exe PID 2652 wrote to memory of 2632 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe schtasks.exe PID 2652 wrote to memory of 2632 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe schtasks.exe PID 2652 wrote to memory of 2632 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe schtasks.exe PID 2652 wrote to memory of 2632 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe schtasks.exe PID 2652 wrote to memory of 2544 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe PID 2652 wrote to memory of 2544 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe PID 2652 wrote to memory of 2544 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe PID 2652 wrote to memory of 2544 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe PID 2652 wrote to memory of 2544 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe PID 2652 wrote to memory of 2544 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe PID 2652 wrote to memory of 2544 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe PID 2652 wrote to memory of 2544 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe PID 2652 wrote to memory of 2544 2652 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe 1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe"C:\Users\Admin\AppData\Local\Temp\1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qHaIsUkesNTEEj.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHaIsUkesNTEEj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBA1B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe"C:\Users\Admin\AppData\Local\Temp\1f46588b3fcef988326ff0ed41ef3fdc9884ed468ff6740d6781122b3c3bd845.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpBA1B.tmpFilesize
1KB
MD548f745781ba37d2817c93588bf943b1d
SHA17719518927b2d7f0464e34a4f357bc5f01a348d1
SHA2560a1950f9e550957f5727891211456c6b2f3582a62667eafc1909328c64a5f133
SHA512cb0368d6515ae2d3951e13b197220cc0b1371e773f953dde211bf9851317492e896d12e2e32cd2bfad69cbe3ea2dd949af546640e2599b8d7862a1bb61699a28
-
memory/2096-28-0x000000006F0A0000-0x000000006F64B000-memory.dmpFilesize
5.7MB
-
memory/2096-29-0x000000006F0A0000-0x000000006F64B000-memory.dmpFilesize
5.7MB
-
memory/2096-31-0x000000006F0A0000-0x000000006F64B000-memory.dmpFilesize
5.7MB
-
memory/2096-30-0x00000000020A0000-0x00000000020E0000-memory.dmpFilesize
256KB
-
memory/2544-33-0x0000000004910000-0x0000000004950000-memory.dmpFilesize
256KB
-
memory/2544-25-0x0000000004910000-0x0000000004950000-memory.dmpFilesize
256KB
-
memory/2544-11-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2544-12-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2544-13-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2544-18-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2544-32-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB
-
memory/2544-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2544-14-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2544-20-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2544-23-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2544-24-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB
-
memory/2652-22-0x0000000073FE0000-0x00000000746CE000-memory.dmpFilesize
6.9MB
-
memory/2652-0-0x0000000000F00000-0x0000000000FB8000-memory.dmpFilesize
736KB
-
memory/2652-5-0x0000000005220000-0x00000000052A4000-memory.dmpFilesize
528KB
-
memory/2652-4-0x0000000000900000-0x000000000090C000-memory.dmpFilesize
48KB
-
memory/2652-2-0x0000000004EB0000-0x0000000004EF0000-memory.dmpFilesize
256KB
-
memory/2652-3-0x00000000003A0000-0x00000000003B2000-memory.dmpFilesize
72KB
-
memory/2652-1-0x0000000073FE0000-0x00000000746CE000-memory.dmpFilesize
6.9MB