Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 07:30
Static task
static1
Behavioral task
behavioral1
Sample
z1PO.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
z1PO.exe
Resource
win10v2004-20231215-en
General
-
Target
z1PO.exe
-
Size
208KB
-
MD5
10b76ce4a151fb9a87c756ddacae357f
-
SHA1
d86ad648734ea7c5372819f9bcec5411b02d6358
-
SHA256
1ad2e5df626723bca2bf7ac89733392b1a44849e1345e90f3cc6d3d034873bd4
-
SHA512
3969e20675af8d718963b7712435922e7697e85c1e1560520d0ba99bc456f1fdf50390a05f980216ed82095c5f6ed169226abc4ffb18f8c584dc8c7dc6326264
-
SSDEEP
3072:LY5Z0ub84cpaiToaOcJ+GMK/ThXQsIZeUdUsIH4UtwaGpefC7GmCMY7pdkW:OTOEiscJ+GMKL6sITUsIH4wGpQ
Malware Config
Extracted
Protocol: ftp- Host:
80.92.205.47 - Port:
21 - Username:
delizzasuppl - Password:
99EK7bvTZr4zBnwW
Extracted
agenttesla
Protocol: ftp- Host:
ftp://80.92.205.47 - Port:
21 - Username:
delizzasuppl - Password:
99EK7bvTZr4zBnwW
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
z1PO.exedescription pid process target process PID 2932 set thread context of 4600 2932 z1PO.exe Caspol.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Caspol.exepid process 4600 Caspol.exe 4600 Caspol.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Caspol.exedescription pid process Token: SeDebugPrivilege 4600 Caspol.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
z1PO.exedescription pid process target process PID 2932 wrote to memory of 4600 2932 z1PO.exe Caspol.exe PID 2932 wrote to memory of 4600 2932 z1PO.exe Caspol.exe PID 2932 wrote to memory of 4600 2932 z1PO.exe Caspol.exe PID 2932 wrote to memory of 4600 2932 z1PO.exe Caspol.exe PID 2932 wrote to memory of 4600 2932 z1PO.exe Caspol.exe PID 2932 wrote to memory of 4600 2932 z1PO.exe Caspol.exe PID 2932 wrote to memory of 4600 2932 z1PO.exe Caspol.exe PID 2932 wrote to memory of 4600 2932 z1PO.exe Caspol.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\z1PO.exe"C:\Users\Admin\AppData\Local\Temp\z1PO.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2932-8-0x0000000074DC0000-0x0000000075570000-memory.dmpFilesize
7.7MB
-
memory/2932-1-0x0000000074DC0000-0x0000000075570000-memory.dmpFilesize
7.7MB
-
memory/2932-2-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB
-
memory/2932-3-0x0000000005060000-0x000000000508E000-memory.dmpFilesize
184KB
-
memory/2932-4-0x00000000050A0000-0x00000000050AA000-memory.dmpFilesize
40KB
-
memory/2932-0-0x0000000000750000-0x000000000078A000-memory.dmpFilesize
232KB
-
memory/4600-9-0x0000000005A80000-0x0000000006024000-memory.dmpFilesize
5.6MB
-
memory/4600-7-0x0000000074DC0000-0x0000000075570000-memory.dmpFilesize
7.7MB
-
memory/4600-5-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/4600-10-0x0000000005450000-0x0000000005460000-memory.dmpFilesize
64KB
-
memory/4600-11-0x0000000005640000-0x00000000056A6000-memory.dmpFilesize
408KB
-
memory/4600-12-0x0000000006820000-0x0000000006870000-memory.dmpFilesize
320KB
-
memory/4600-13-0x0000000006910000-0x00000000069AC000-memory.dmpFilesize
624KB
-
memory/4600-14-0x0000000006A50000-0x0000000006AE2000-memory.dmpFilesize
584KB
-
memory/4600-15-0x00000000069B0000-0x00000000069BA000-memory.dmpFilesize
40KB
-
memory/4600-16-0x0000000074DC0000-0x0000000075570000-memory.dmpFilesize
7.7MB
-
memory/4600-17-0x0000000005450000-0x0000000005460000-memory.dmpFilesize
64KB