Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 03:08
Static task
static1
Behavioral task
behavioral1
Sample
PO#241001759.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PO#241001759.exe
Resource
win10v2004-20240226-en
General
-
Target
PO#241001759.exe
-
Size
729KB
-
MD5
41d2427d475c087b6742c8d3881b3847
-
SHA1
36d9144f3b2cb8b8f72d7e20c0f7b20cf97fb7a6
-
SHA256
f17b902f094220be7501fbf02ca5e258de6458939b097f60705f8872fc3c73b7
-
SHA512
93716040d79093780f93a9a4448048c2c1d1819b99030c3d27003087b8cb7dbc3183d1afab88437f9108ca70ce6eb7d585847ab0580325dc647b155daeadf5c0
-
SSDEEP
12288:INeOQx3TdpCmdIdL2/2gHecoI/v0b24w135wltCE5UrMkpOTOudkdRsoBiQ:kixjdpfId65Jn/r4m5wfCMop6OeoR/EQ
Malware Config
Extracted
Protocol: smtp- Host:
mail.kabeercommodities.com - Port:
587 - Username:
[email protected] - Password:
w{A6H.o&sz%g
Extracted
agenttesla
Protocol: smtp- Host:
mail.kabeercommodities.com - Port:
587 - Username:
[email protected] - Password:
w{A6H.o&sz%g - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PO#241001759.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation PO#241001759.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 47 api.ipify.org 49 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO#241001759.exedescription pid process target process PID 4840 set thread context of 3432 4840 PO#241001759.exe PO#241001759.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
PO#241001759.exepowershell.exepowershell.exePO#241001759.exepid process 4840 PO#241001759.exe 4840 PO#241001759.exe 3372 powershell.exe 3372 powershell.exe 3564 powershell.exe 3564 powershell.exe 4840 PO#241001759.exe 4840 PO#241001759.exe 4840 PO#241001759.exe 4840 PO#241001759.exe 3432 PO#241001759.exe 3432 PO#241001759.exe 3432 PO#241001759.exe 3564 powershell.exe 3372 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PO#241001759.exepowershell.exepowershell.exePO#241001759.exedescription pid process Token: SeDebugPrivilege 4840 PO#241001759.exe Token: SeDebugPrivilege 3564 powershell.exe Token: SeDebugPrivilege 3372 powershell.exe Token: SeDebugPrivilege 3432 PO#241001759.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
PO#241001759.exedescription pid process target process PID 4840 wrote to memory of 3564 4840 PO#241001759.exe powershell.exe PID 4840 wrote to memory of 3564 4840 PO#241001759.exe powershell.exe PID 4840 wrote to memory of 3564 4840 PO#241001759.exe powershell.exe PID 4840 wrote to memory of 3372 4840 PO#241001759.exe powershell.exe PID 4840 wrote to memory of 3372 4840 PO#241001759.exe powershell.exe PID 4840 wrote to memory of 3372 4840 PO#241001759.exe powershell.exe PID 4840 wrote to memory of 1748 4840 PO#241001759.exe schtasks.exe PID 4840 wrote to memory of 1748 4840 PO#241001759.exe schtasks.exe PID 4840 wrote to memory of 1748 4840 PO#241001759.exe schtasks.exe PID 4840 wrote to memory of 4764 4840 PO#241001759.exe PO#241001759.exe PID 4840 wrote to memory of 4764 4840 PO#241001759.exe PO#241001759.exe PID 4840 wrote to memory of 4764 4840 PO#241001759.exe PO#241001759.exe PID 4840 wrote to memory of 3432 4840 PO#241001759.exe PO#241001759.exe PID 4840 wrote to memory of 3432 4840 PO#241001759.exe PO#241001759.exe PID 4840 wrote to memory of 3432 4840 PO#241001759.exe PO#241001759.exe PID 4840 wrote to memory of 3432 4840 PO#241001759.exe PO#241001759.exe PID 4840 wrote to memory of 3432 4840 PO#241001759.exe PO#241001759.exe PID 4840 wrote to memory of 3432 4840 PO#241001759.exe PO#241001759.exe PID 4840 wrote to memory of 3432 4840 PO#241001759.exe PO#241001759.exe PID 4840 wrote to memory of 3432 4840 PO#241001759.exe PO#241001759.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO#241001759.exe"C:\Users\Admin\AppData\Local\Temp\PO#241001759.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO#241001759.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GlIToApjgGEL.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8B0A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PO#241001759.exe"C:\Users\Admin\AppData\Local\Temp\PO#241001759.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO#241001759.exe"C:\Users\Admin\AppData\Local\Temp\PO#241001759.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO#241001759.exe.logFilesize
1KB
MD57cad59aef5a93f093b6ba494f13f796f
SHA13cef97b77939bfc06dfd3946fc1a8cd159f67100
SHA2561e1b444fe2d8772f6709b22b94bb5b0aa7fa590f6a693705d9bf1f2f71267a55
SHA5128cedd03efec34c6226a01fd6b4831a689be16545ea6b849cd96f775e0722bfefd4b47f3dd8401d2080d341d4319f75995ece60de44352a1f86a2e5dc01e6210b
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD577a0a33236770fcdfbde057438265c83
SHA1d37980f1575db5ff2b27eb42cb45f3f9d9f93a1a
SHA256fd83c6abcf695119e9754a3844d3296bf4d2364f9185b9c331531314eff12e60
SHA5123c84ed2d2f0e79780ff727f2c4ecdd4ba4dc63cf882392eb8e6da590b900f5b0fec717a10df450298c229260bd64d77f89872f0e7a0de909b1f8cdac93a1cbe9
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jglwksbr.5vx.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp8B0A.tmpFilesize
1KB
MD5ce1b198f7a4b93b151970dc0d57e93c9
SHA12626ddcc897d628b887ebd1798e307452fdb0638
SHA2567d35617519eb0fb72209a19beca0ca45f2d42213fcafa451576dabc74133ef6e
SHA512145b455e6aaac83584528e12bf1343b308a372a4a1f9c3f61a7dd4eeecdecf1894873e01299673f3a774d2a3e10ffb7ddb47a79b8eb0e1b6b19e8372c63a8ee7
-
memory/3372-80-0x0000000007480000-0x000000000748A000-memory.dmpFilesize
40KB
-
memory/3372-20-0x00000000027A0000-0x00000000027B0000-memory.dmpFilesize
64KB
-
memory/3372-86-0x0000000007730000-0x0000000007738000-memory.dmpFilesize
32KB
-
memory/3372-84-0x0000000007650000-0x0000000007664000-memory.dmpFilesize
80KB
-
memory/3372-83-0x0000000007640000-0x000000000764E000-memory.dmpFilesize
56KB
-
memory/3372-23-0x00000000747A0000-0x0000000074F50000-memory.dmpFilesize
7.7MB
-
memory/3372-68-0x00000000027A0000-0x00000000027B0000-memory.dmpFilesize
64KB
-
memory/3372-67-0x0000000070AE0000-0x0000000070B2C000-memory.dmpFilesize
304KB
-
memory/3372-25-0x0000000005AC0000-0x0000000005B26000-memory.dmpFilesize
408KB
-
memory/3372-93-0x00000000747A0000-0x0000000074F50000-memory.dmpFilesize
7.7MB
-
memory/3372-19-0x00000000027A0000-0x00000000027B0000-memory.dmpFilesize
64KB
-
memory/3432-48-0x00000000747A0000-0x0000000074F50000-memory.dmpFilesize
7.7MB
-
memory/3432-94-0x0000000006A80000-0x0000000006AD0000-memory.dmpFilesize
320KB
-
memory/3432-95-0x00000000747A0000-0x0000000074F50000-memory.dmpFilesize
7.7MB
-
memory/3432-96-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/3432-49-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/3432-44-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3564-17-0x0000000005850000-0x0000000005E78000-memory.dmpFilesize
6.2MB
-
memory/3564-78-0x0000000007E90000-0x000000000850A000-memory.dmpFilesize
6.5MB
-
memory/3564-21-0x0000000005460000-0x0000000005482000-memory.dmpFilesize
136KB
-
memory/3564-92-0x00000000747A0000-0x0000000074F50000-memory.dmpFilesize
7.7MB
-
memory/3564-18-0x0000000002E20000-0x0000000002E30000-memory.dmpFilesize
64KB
-
memory/3564-85-0x0000000007B90000-0x0000000007BAA000-memory.dmpFilesize
104KB
-
memory/3564-50-0x0000000006510000-0x000000000652E000-memory.dmpFilesize
120KB
-
memory/3564-51-0x00000000065D0000-0x000000000661C000-memory.dmpFilesize
304KB
-
memory/3564-54-0x0000000070AE0000-0x0000000070B2C000-memory.dmpFilesize
304KB
-
memory/3564-64-0x0000000007480000-0x000000000749E000-memory.dmpFilesize
120KB
-
memory/3564-65-0x0000000002E20000-0x0000000002E30000-memory.dmpFilesize
64KB
-
memory/3564-66-0x00000000076F0000-0x0000000007793000-memory.dmpFilesize
652KB
-
memory/3564-16-0x00000000747A0000-0x0000000074F50000-memory.dmpFilesize
7.7MB
-
memory/3564-15-0x0000000002BE0000-0x0000000002C16000-memory.dmpFilesize
216KB
-
memory/3564-53-0x00000000074A0000-0x00000000074D2000-memory.dmpFilesize
200KB
-
memory/3564-24-0x0000000005E80000-0x0000000005EE6000-memory.dmpFilesize
408KB
-
memory/3564-79-0x0000000007850000-0x000000000786A000-memory.dmpFilesize
104KB
-
memory/3564-82-0x0000000007A50000-0x0000000007A61000-memory.dmpFilesize
68KB
-
memory/3564-52-0x000000007F7F0000-0x000000007F800000-memory.dmpFilesize
64KB
-
memory/3564-81-0x0000000007AD0000-0x0000000007B66000-memory.dmpFilesize
600KB
-
memory/4840-10-0x00000000086A0000-0x0000000008722000-memory.dmpFilesize
520KB
-
memory/4840-9-0x0000000006270000-0x000000000627C000-memory.dmpFilesize
48KB
-
memory/4840-8-0x0000000005BB0000-0x0000000005BC2000-memory.dmpFilesize
72KB
-
memory/4840-0-0x0000000000A40000-0x0000000000AFC000-memory.dmpFilesize
752KB
-
memory/4840-7-0x0000000008600000-0x000000000869C000-memory.dmpFilesize
624KB
-
memory/4840-6-0x00000000055E0000-0x00000000055EA000-memory.dmpFilesize
40KB
-
memory/4840-5-0x00000000056F0000-0x0000000005700000-memory.dmpFilesize
64KB
-
memory/4840-47-0x00000000747A0000-0x0000000074F50000-memory.dmpFilesize
7.7MB
-
memory/4840-4-0x0000000005700000-0x0000000005A54000-memory.dmpFilesize
3.3MB
-
memory/4840-3-0x0000000005500000-0x0000000005592000-memory.dmpFilesize
584KB
-
memory/4840-2-0x0000000005BC0000-0x0000000006164000-memory.dmpFilesize
5.6MB
-
memory/4840-1-0x00000000747A0000-0x0000000074F50000-memory.dmpFilesize
7.7MB