Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 03:04
Static task
static1
Behavioral task
behavioral1
Sample
a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe
Resource
win10v2004-20240226-en
General
-
Target
a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe
-
Size
712KB
-
MD5
91a4e682ebc54e8fd63edf2d6622b216
-
SHA1
8e69dfb01beccbb6dd7b6b3a3cd58cd750c823ec
-
SHA256
a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b
-
SHA512
fbe33dd9c2727b1da3635be3442e5beee8ff0ceba29ba5a76d2b329576b4c960c1899c38de88a4e497e4e90f855f652b92307772a3d4581e9c2dfaca1efdc18f
-
SSDEEP
12288:s4CMwRX2hu6MiFBGT/t05fUulNpGMg1VaFVvNw8GlJ2KpmjFGH8A:3ai6t051/pBxKpW
Malware Config
Extracted
Protocol: smtp- Host:
mail.ozgurmob.com - Port:
587 - Username:
[email protected] - Password:
beko(1453)(3959)
Extracted
agenttesla
Protocol: smtp- Host:
mail.ozgurmob.com - Port:
587 - Username:
[email protected] - Password:
beko(1453)(3959) - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctsdvwT = "C:\\Users\\Admin\\AppData\\Roaming\\ctsdvwT\\ctsdvwT.exe" a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exedescription pid process target process PID 2260 set thread context of 4692 2260 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exea87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exepowershell.exepid process 2260 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe 2260 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe 2260 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe 4692 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe 4692 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe 4692 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe 2476 powershell.exe 2476 powershell.exe 2476 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exea87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exepowershell.exedescription pid process Token: SeDebugPrivilege 2260 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe Token: SeDebugPrivilege 4692 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe Token: SeDebugPrivilege 2476 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exepid process 4692 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exedescription pid process target process PID 2260 wrote to memory of 2476 2260 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe powershell.exe PID 2260 wrote to memory of 2476 2260 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe powershell.exe PID 2260 wrote to memory of 2476 2260 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe powershell.exe PID 2260 wrote to memory of 4692 2260 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe PID 2260 wrote to memory of 4692 2260 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe PID 2260 wrote to memory of 4692 2260 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe PID 2260 wrote to memory of 4692 2260 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe PID 2260 wrote to memory of 4692 2260 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe PID 2260 wrote to memory of 4692 2260 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe PID 2260 wrote to memory of 4692 2260 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe PID 2260 wrote to memory of 4692 2260 a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe"C:\Users\Admin\AppData\Local\Temp\a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe"C:\Users\Admin\AppData\Local\Temp\a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sdqgkw4h.3o5.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/2260-13-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/2260-1-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/2260-2-0x0000000005C60000-0x0000000006204000-memory.dmpFilesize
5.6MB
-
memory/2260-3-0x0000000005750000-0x00000000057E2000-memory.dmpFilesize
584KB
-
memory/2260-4-0x0000000005900000-0x0000000005910000-memory.dmpFilesize
64KB
-
memory/2260-5-0x00000000056D0000-0x00000000056DA000-memory.dmpFilesize
40KB
-
memory/2260-6-0x0000000005A00000-0x0000000005A9C000-memory.dmpFilesize
624KB
-
memory/2260-7-0x0000000005840000-0x0000000005852000-memory.dmpFilesize
72KB
-
memory/2260-8-0x0000000005870000-0x000000000587C000-memory.dmpFilesize
48KB
-
memory/2260-9-0x0000000006CD0000-0x0000000006D52000-memory.dmpFilesize
520KB
-
memory/2260-0-0x0000000000C20000-0x0000000000CD6000-memory.dmpFilesize
728KB
-
memory/2476-52-0x0000000007EE0000-0x000000000855A000-memory.dmpFilesize
6.5MB
-
memory/2476-48-0x0000000007530000-0x000000000754E000-memory.dmpFilesize
120KB
-
memory/2476-15-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/2476-16-0x0000000004FE0000-0x0000000004FF0000-memory.dmpFilesize
64KB
-
memory/2476-63-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/2476-20-0x0000000005620000-0x0000000005C48000-memory.dmpFilesize
6.2MB
-
memory/2476-19-0x0000000004FE0000-0x0000000004FF0000-memory.dmpFilesize
64KB
-
memory/2476-60-0x0000000007BC0000-0x0000000007BC8000-memory.dmpFilesize
32KB
-
memory/2476-21-0x00000000054D0000-0x00000000054F2000-memory.dmpFilesize
136KB
-
memory/2476-22-0x0000000005D40000-0x0000000005DA6000-memory.dmpFilesize
408KB
-
memory/2476-59-0x0000000007BE0000-0x0000000007BFA000-memory.dmpFilesize
104KB
-
memory/2476-32-0x00000000060D0000-0x0000000006424000-memory.dmpFilesize
3.3MB
-
memory/2476-33-0x0000000006550000-0x000000000656E000-memory.dmpFilesize
120KB
-
memory/2476-34-0x00000000065F0000-0x000000000663C000-memory.dmpFilesize
304KB
-
memory/2476-36-0x000000007F4D0000-0x000000007F4E0000-memory.dmpFilesize
64KB
-
memory/2476-38-0x0000000070FB0000-0x0000000070FFC000-memory.dmpFilesize
304KB
-
memory/2476-37-0x0000000006B20000-0x0000000006B52000-memory.dmpFilesize
200KB
-
memory/2476-14-0x0000000004FA0000-0x0000000004FD6000-memory.dmpFilesize
216KB
-
memory/2476-50-0x0000000004FE0000-0x0000000004FF0000-memory.dmpFilesize
64KB
-
memory/2476-51-0x0000000007560000-0x0000000007603000-memory.dmpFilesize
652KB
-
memory/2476-58-0x0000000007AE0000-0x0000000007AF4000-memory.dmpFilesize
80KB
-
memory/2476-57-0x0000000007AD0000-0x0000000007ADE000-memory.dmpFilesize
56KB
-
memory/2476-53-0x00000000078A0000-0x00000000078BA000-memory.dmpFilesize
104KB
-
memory/2476-54-0x0000000007910000-0x000000000791A000-memory.dmpFilesize
40KB
-
memory/2476-55-0x0000000007B20000-0x0000000007BB6000-memory.dmpFilesize
600KB
-
memory/2476-56-0x0000000007AA0000-0x0000000007AB1000-memory.dmpFilesize
68KB
-
memory/4692-10-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/4692-49-0x0000000006370000-0x00000000063C0000-memory.dmpFilesize
320KB
-
memory/4692-12-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/4692-18-0x0000000005490000-0x00000000054F6000-memory.dmpFilesize
408KB
-
memory/4692-17-0x00000000051D0000-0x00000000051E0000-memory.dmpFilesize
64KB
-
memory/4692-64-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/4692-65-0x00000000051D0000-0x00000000051E0000-memory.dmpFilesize
64KB