Analysis
-
max time kernel
122s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 01:40
Static task
static1
Behavioral task
behavioral1
Sample
77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe
Resource
win10v2004-20240226-en
General
-
Target
77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe
-
Size
900KB
-
MD5
6ec0abebef7ba50b0875e8279e2261e6
-
SHA1
b2d2801d8313d006301d3d0c733c0cf9c4f5ca53
-
SHA256
77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7
-
SHA512
4d957f94258b4f18712b98e9b240a3af525e534d59e05f644733d2bc276ab0e8dc118ae3fb2b7499b060e5b21b852458cc539129afa50ad6bf3a16d324403a17
-
SSDEEP
24576:BwjFrqN2Tdp7BmyN+0U7kWVv4+IF6nnjqKoe:WjBg2RHkPzy+LjqKoe
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cherubimsecurityforce.com - Port:
587 - Username:
[email protected] - Password:
alwarpet538 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exedescription pid process target process PID 2096 set thread context of 2536 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exepowershell.exepowershell.exepid process 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe 2536 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe 2536 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe 2532 powershell.exe 2076 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe Token: SeDebugPrivilege 2536 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe Token: SeDebugPrivilege 2532 powershell.exe Token: SeDebugPrivilege 2076 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exepid process 2536 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exedescription pid process target process PID 2096 wrote to memory of 2076 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe powershell.exe PID 2096 wrote to memory of 2076 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe powershell.exe PID 2096 wrote to memory of 2076 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe powershell.exe PID 2096 wrote to memory of 2076 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe powershell.exe PID 2096 wrote to memory of 2532 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe powershell.exe PID 2096 wrote to memory of 2532 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe powershell.exe PID 2096 wrote to memory of 2532 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe powershell.exe PID 2096 wrote to memory of 2532 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe powershell.exe PID 2096 wrote to memory of 2692 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe schtasks.exe PID 2096 wrote to memory of 2692 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe schtasks.exe PID 2096 wrote to memory of 2692 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe schtasks.exe PID 2096 wrote to memory of 2692 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe schtasks.exe PID 2096 wrote to memory of 2536 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe PID 2096 wrote to memory of 2536 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe PID 2096 wrote to memory of 2536 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe PID 2096 wrote to memory of 2536 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe PID 2096 wrote to memory of 2536 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe PID 2096 wrote to memory of 2536 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe PID 2096 wrote to memory of 2536 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe PID 2096 wrote to memory of 2536 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe PID 2096 wrote to memory of 2536 2096 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe 77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe"C:\Users\Admin\AppData\Local\Temp\77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dHdovcQ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dHdovcQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAF14.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe"C:\Users\Admin\AppData\Local\Temp\77240f128f1bc134d37049e3885be91224e7314f127e253db534b667ad5bb7f7.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpAF14.tmpFilesize
1KB
MD5da592c5480b88a9a8873e19d4629d7a5
SHA197ac3fc587ad8740fd5869ef57dcac6319ae5f8e
SHA256071c5520b5ec5fed91eb19d785e6fc89ee70bf22cfb0d8402732aa1985dd1d6d
SHA512d46fd84b5f35509322ffc8a2428063fb590b47b49213fbe7838638bec605f3b336f7c0173d9a5ffb2058b84dee1de22276fbb6d8a95d1a2d6e660ef7a5b5ed38
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD59d30c5b4473a7e678b00144ba5b3c9a3
SHA146acdd035584c00cd176af9a1022a615dcad4cfd
SHA256fbd98b559a66ca881aa823576bd6be40a99fa024917bf4dc66f470a8460ff3d2
SHA51235ba7fc7d16f4e7e47c560339fcbab49e816e8ad748f3717ab4f08b6f5c07e75d4b96b0ea3717fefc7db95fd480212174ccaf22fa174ac69637658010c2333e9
-
memory/2076-35-0x000000006F750000-0x000000006FCFB000-memory.dmpFilesize
5.7MB
-
memory/2076-40-0x000000006F750000-0x000000006FCFB000-memory.dmpFilesize
5.7MB
-
memory/2076-31-0x000000006F750000-0x000000006FCFB000-memory.dmpFilesize
5.7MB
-
memory/2076-37-0x0000000002780000-0x00000000027C0000-memory.dmpFilesize
256KB
-
memory/2076-34-0x0000000002780000-0x00000000027C0000-memory.dmpFilesize
256KB
-
memory/2096-3-0x0000000000390000-0x00000000003A2000-memory.dmpFilesize
72KB
-
memory/2096-1-0x0000000074C30000-0x000000007531E000-memory.dmpFilesize
6.9MB
-
memory/2096-30-0x0000000074C30000-0x000000007531E000-memory.dmpFilesize
6.9MB
-
memory/2096-0-0x0000000000F80000-0x0000000001066000-memory.dmpFilesize
920KB
-
memory/2096-2-0x0000000004B20000-0x0000000004B60000-memory.dmpFilesize
256KB
-
memory/2096-4-0x00000000003B0000-0x00000000003BC000-memory.dmpFilesize
48KB
-
memory/2096-5-0x00000000053C0000-0x0000000005442000-memory.dmpFilesize
520KB
-
memory/2532-33-0x0000000002900000-0x0000000002940000-memory.dmpFilesize
256KB
-
memory/2532-38-0x000000006F750000-0x000000006FCFB000-memory.dmpFilesize
5.7MB
-
memory/2532-32-0x000000006F750000-0x000000006FCFB000-memory.dmpFilesize
5.7MB
-
memory/2532-41-0x000000006F750000-0x000000006FCFB000-memory.dmpFilesize
5.7MB
-
memory/2536-20-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2536-42-0x0000000074C30000-0x000000007531E000-memory.dmpFilesize
6.9MB
-
memory/2536-25-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2536-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2536-36-0x0000000074C30000-0x000000007531E000-memory.dmpFilesize
6.9MB
-
memory/2536-22-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2536-39-0x0000000004A70000-0x0000000004AB0000-memory.dmpFilesize
256KB
-
memory/2536-21-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2536-18-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2536-27-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2536-29-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB