Analysis
-
max time kernel
122s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 06:57
Static task
static1
Behavioral task
behavioral1
Sample
hesaphareketi-01.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
hesaphareketi-01.exe
Resource
win10v2004-20240226-en
General
-
Target
hesaphareketi-01.exe
-
Size
675KB
-
MD5
457e798bc2159b05a4c42047349aed4e
-
SHA1
75c0f721282465e22020a8b78bdfcd0a6617f877
-
SHA256
66411161faca1e2387d246ef7d69d73cf2f848725546f6cfcc87bb4c4851bb9b
-
SHA512
030b7d6fac4218b591a635465dde7de2a9d57cd4eb50750db0b65917eed105443d22e5b38783b099112f752231d009994959b9d31ac06e1d5d8a2f99135d0cd7
-
SSDEEP
6144:TZ6yPoa2GhNl6AnwIcGwYXgrkMY358MZ3kFOO9I6zpq6erP6gppadQ/7TviOWBWi:oa2iNlw0PmkNMO4I6zpOqde6nKfX1kR
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.zqamcx.com - Port:
587 - Username:
[email protected] - Password:
Anambraeast@ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
hesaphareketi-01.exedescription pid process target process PID 2884 set thread context of 2780 2884 hesaphareketi-01.exe hesaphareketi-01.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
hesaphareketi-01.exehesaphareketi-01.exepowershell.exepowershell.exepid process 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2884 hesaphareketi-01.exe 2780 hesaphareketi-01.exe 2780 hesaphareketi-01.exe 2520 powershell.exe 2368 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
hesaphareketi-01.exehesaphareketi-01.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2884 hesaphareketi-01.exe Token: SeDebugPrivilege 2780 hesaphareketi-01.exe Token: SeDebugPrivilege 2520 powershell.exe Token: SeDebugPrivilege 2368 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
hesaphareketi-01.exepid process 2780 hesaphareketi-01.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
hesaphareketi-01.exedescription pid process target process PID 2884 wrote to memory of 2368 2884 hesaphareketi-01.exe powershell.exe PID 2884 wrote to memory of 2368 2884 hesaphareketi-01.exe powershell.exe PID 2884 wrote to memory of 2368 2884 hesaphareketi-01.exe powershell.exe PID 2884 wrote to memory of 2368 2884 hesaphareketi-01.exe powershell.exe PID 2884 wrote to memory of 2520 2884 hesaphareketi-01.exe powershell.exe PID 2884 wrote to memory of 2520 2884 hesaphareketi-01.exe powershell.exe PID 2884 wrote to memory of 2520 2884 hesaphareketi-01.exe powershell.exe PID 2884 wrote to memory of 2520 2884 hesaphareketi-01.exe powershell.exe PID 2884 wrote to memory of 3060 2884 hesaphareketi-01.exe schtasks.exe PID 2884 wrote to memory of 3060 2884 hesaphareketi-01.exe schtasks.exe PID 2884 wrote to memory of 3060 2884 hesaphareketi-01.exe schtasks.exe PID 2884 wrote to memory of 3060 2884 hesaphareketi-01.exe schtasks.exe PID 2884 wrote to memory of 2780 2884 hesaphareketi-01.exe hesaphareketi-01.exe PID 2884 wrote to memory of 2780 2884 hesaphareketi-01.exe hesaphareketi-01.exe PID 2884 wrote to memory of 2780 2884 hesaphareketi-01.exe hesaphareketi-01.exe PID 2884 wrote to memory of 2780 2884 hesaphareketi-01.exe hesaphareketi-01.exe PID 2884 wrote to memory of 2780 2884 hesaphareketi-01.exe hesaphareketi-01.exe PID 2884 wrote to memory of 2780 2884 hesaphareketi-01.exe hesaphareketi-01.exe PID 2884 wrote to memory of 2780 2884 hesaphareketi-01.exe hesaphareketi-01.exe PID 2884 wrote to memory of 2780 2884 hesaphareketi-01.exe hesaphareketi-01.exe PID 2884 wrote to memory of 2780 2884 hesaphareketi-01.exe hesaphareketi-01.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe"C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DPitdstfgiH.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DPitdstfgiH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp46FF.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe"C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp46FF.tmpFilesize
1KB
MD55fad0766b6767e2074a406623e89b66e
SHA193229f37f3e9fd6f80742658e165c375c475ef5f
SHA2561d6c0fbbef6d6e7079850e91c3a2c3701ab21b209e37829ff00ea89f91378580
SHA51238d8379c476323834048c825d01c982588355c3844c5bb9ab13499f63ad6f5e219d84141d5572128d13e8c9daca172f560c741904a8fefb6f7e32981142f37b5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5c7ec6e4615443503eb8e6410163c25e6
SHA1bd542aede2ff5c2b82684aaf528cf1a552132b72
SHA25610116a9b8543f5143d25b7b81f4b80598b1689df171a6a019d0f4bc923ecf4ce
SHA51230a9e485d09176d6da5cfa6b320e6a7ac7371ff890d4606b2aaa3f730e775db9792cf0f9e4569bdd685e57a884a8a3a14b4d7ed1363e6d540a8d94a861491a2b
-
memory/2368-44-0x000000006E7C0000-0x000000006ED6B000-memory.dmpFilesize
5.7MB
-
memory/2368-43-0x00000000026D0000-0x0000000002710000-memory.dmpFilesize
256KB
-
memory/2368-42-0x00000000026D0000-0x0000000002710000-memory.dmpFilesize
256KB
-
memory/2368-36-0x000000006E7C0000-0x000000006ED6B000-memory.dmpFilesize
5.7MB
-
memory/2368-34-0x000000006E7C0000-0x000000006ED6B000-memory.dmpFilesize
5.7MB
-
memory/2520-39-0x0000000002800000-0x0000000002840000-memory.dmpFilesize
256KB
-
memory/2520-35-0x000000006E7C0000-0x000000006ED6B000-memory.dmpFilesize
5.7MB
-
memory/2520-45-0x000000006E7C0000-0x000000006ED6B000-memory.dmpFilesize
5.7MB
-
memory/2520-40-0x0000000002800000-0x0000000002840000-memory.dmpFilesize
256KB
-
memory/2520-38-0x000000006E7C0000-0x000000006ED6B000-memory.dmpFilesize
5.7MB
-
memory/2520-37-0x0000000002800000-0x0000000002840000-memory.dmpFilesize
256KB
-
memory/2780-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2780-41-0x0000000074B60000-0x000000007524E000-memory.dmpFilesize
6.9MB
-
memory/2780-28-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2780-30-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2780-32-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2780-46-0x0000000074B60000-0x000000007524E000-memory.dmpFilesize
6.9MB
-
memory/2780-20-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2780-24-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2780-21-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2780-22-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2884-4-0x0000000000470000-0x000000000047C000-memory.dmpFilesize
48KB
-
memory/2884-0-0x0000000000A50000-0x0000000000AFA000-memory.dmpFilesize
680KB
-
memory/2884-5-0x0000000005220000-0x00000000052A4000-memory.dmpFilesize
528KB
-
memory/2884-7-0x0000000004330000-0x0000000004370000-memory.dmpFilesize
256KB
-
memory/2884-3-0x0000000000450000-0x0000000000462000-memory.dmpFilesize
72KB
-
memory/2884-2-0x0000000004330000-0x0000000004370000-memory.dmpFilesize
256KB
-
memory/2884-6-0x0000000074B60000-0x000000007524E000-memory.dmpFilesize
6.9MB
-
memory/2884-1-0x0000000074B60000-0x000000007524E000-memory.dmpFilesize
6.9MB
-
memory/2884-33-0x0000000074B60000-0x000000007524E000-memory.dmpFilesize
6.9MB