Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 01:04
Static task
static1
Behavioral task
behavioral1
Sample
L47fz5X2RSrsQIn.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
L47fz5X2RSrsQIn.exe
Resource
win10v2004-20240226-en
General
-
Target
L47fz5X2RSrsQIn.exe
-
Size
658KB
-
MD5
5313954569433d6b29f6b81862080ae8
-
SHA1
c113656034eed6c5c6ceaf247a20e002bee317f6
-
SHA256
fad66fe6b9c99e9b74fc56c06512b5d90a1296d15afba3cc356389524deb56f4
-
SHA512
db00b6329e45c709ac0bd13aecaec04c8d2593ab20f7fa67196aa67fb709055540e42bb1938fa36c143a2d56fd90ea0ebce953b8d1dbe1f0aa7114c24d0a2206
-
SSDEEP
12288:byzH2iNlw0m3JX7uJAaMOdUpzrrEwbczfnlU747hx7sG683NLoVS3cit:g1Xu34JjMpzrrEwbcDnlU7SnsaaO
Malware Config
Extracted
Protocol: smtp- Host:
mail.magnatextile.com - Port:
587 - Username:
[email protected] - Password:
ac%{*}mti{*}$es
Extracted
agenttesla
Protocol: smtp- Host:
mail.magnatextile.com - Port:
587 - Username:
[email protected] - Password:
ac%{*}mti{*}$es - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
L47fz5X2RSrsQIn.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation L47fz5X2RSrsQIn.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 27 api.ipify.org 28 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
L47fz5X2RSrsQIn.exedescription pid process target process PID 3912 set thread context of 2716 3912 L47fz5X2RSrsQIn.exe L47fz5X2RSrsQIn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exeL47fz5X2RSrsQIn.exepid process 4952 powershell.exe 3208 powershell.exe 2716 L47fz5X2RSrsQIn.exe 2716 L47fz5X2RSrsQIn.exe 4952 powershell.exe 3208 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exeL47fz5X2RSrsQIn.exedescription pid process Token: SeDebugPrivilege 4952 powershell.exe Token: SeDebugPrivilege 3208 powershell.exe Token: SeDebugPrivilege 2716 L47fz5X2RSrsQIn.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
L47fz5X2RSrsQIn.exedescription pid process target process PID 3912 wrote to memory of 4952 3912 L47fz5X2RSrsQIn.exe powershell.exe PID 3912 wrote to memory of 4952 3912 L47fz5X2RSrsQIn.exe powershell.exe PID 3912 wrote to memory of 4952 3912 L47fz5X2RSrsQIn.exe powershell.exe PID 3912 wrote to memory of 3208 3912 L47fz5X2RSrsQIn.exe powershell.exe PID 3912 wrote to memory of 3208 3912 L47fz5X2RSrsQIn.exe powershell.exe PID 3912 wrote to memory of 3208 3912 L47fz5X2RSrsQIn.exe powershell.exe PID 3912 wrote to memory of 4916 3912 L47fz5X2RSrsQIn.exe schtasks.exe PID 3912 wrote to memory of 4916 3912 L47fz5X2RSrsQIn.exe schtasks.exe PID 3912 wrote to memory of 4916 3912 L47fz5X2RSrsQIn.exe schtasks.exe PID 3912 wrote to memory of 2716 3912 L47fz5X2RSrsQIn.exe L47fz5X2RSrsQIn.exe PID 3912 wrote to memory of 2716 3912 L47fz5X2RSrsQIn.exe L47fz5X2RSrsQIn.exe PID 3912 wrote to memory of 2716 3912 L47fz5X2RSrsQIn.exe L47fz5X2RSrsQIn.exe PID 3912 wrote to memory of 2716 3912 L47fz5X2RSrsQIn.exe L47fz5X2RSrsQIn.exe PID 3912 wrote to memory of 2716 3912 L47fz5X2RSrsQIn.exe L47fz5X2RSrsQIn.exe PID 3912 wrote to memory of 2716 3912 L47fz5X2RSrsQIn.exe L47fz5X2RSrsQIn.exe PID 3912 wrote to memory of 2716 3912 L47fz5X2RSrsQIn.exe L47fz5X2RSrsQIn.exe PID 3912 wrote to memory of 2716 3912 L47fz5X2RSrsQIn.exe L47fz5X2RSrsQIn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\L47fz5X2RSrsQIn.exe"C:\Users\Admin\AppData\Local\Temp\L47fz5X2RSrsQIn.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\L47fz5X2RSrsQIn.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\exvGSYJA.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\exvGSYJA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC68C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\L47fz5X2RSrsQIn.exe"C:\Users\Admin\AppData\Local\Temp\L47fz5X2RSrsQIn.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD57702dce8319f11df8c466bf8aefca5ae
SHA1a16f2720d809e003a3a537b1601ca97245054557
SHA256e881bc91ed14b9b6b9e8b0a610b8223e2af67304c9a20e9da163f527294be4a0
SHA51218c5afb444d6ad3c7fb24ba13b890764a5aa63cf759cbfcbe588cf855c2c13d3b965e2093f61d1b8b9a444fdc187063d17cf016b24bafe83735cbf00657e6f84
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mpw1yot0.elc.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpC68C.tmpFilesize
1KB
MD5637de297ebe848f440250808fd0badba
SHA1f94e7f186b1a6fe64e3bfe2e34bbd4b1267a83b9
SHA2569f79477f97e914153558175f4b21a86f06ab502718becca345a3138d16f86f7b
SHA512bcf1e1d1e528396d72b38f792a7d712e8979cd8f44d74c0c9ab36fb82ae8a8b35d34baa374b7fff30ebdb6b0661fb605c22c2948c59d00ed270628ad4b157d84
-
memory/2716-100-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/2716-87-0x0000000006590000-0x00000000065E0000-memory.dmpFilesize
320KB
-
memory/2716-51-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/2716-50-0x00000000749C0000-0x0000000075170000-memory.dmpFilesize
7.7MB
-
memory/2716-42-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2716-99-0x00000000749C0000-0x0000000075170000-memory.dmpFilesize
7.7MB
-
memory/3208-26-0x0000000005D00000-0x0000000005D22000-memory.dmpFilesize
136KB
-
memory/3208-23-0x0000000002BE0000-0x0000000002BF0000-memory.dmpFilesize
64KB
-
memory/3208-98-0x00000000749C0000-0x0000000075170000-memory.dmpFilesize
7.7MB
-
memory/3208-84-0x0000000007820000-0x000000000782A000-memory.dmpFilesize
40KB
-
memory/3208-81-0x000000007FC80000-0x000000007FC90000-memory.dmpFilesize
64KB
-
memory/3208-19-0x00000000749C0000-0x0000000075170000-memory.dmpFilesize
7.7MB
-
memory/3208-73-0x0000000007680000-0x0000000007723000-memory.dmpFilesize
652KB
-
memory/3208-69-0x0000000006A50000-0x0000000006A6E000-memory.dmpFilesize
120KB
-
memory/3208-22-0x0000000002BE0000-0x0000000002BF0000-memory.dmpFilesize
64KB
-
memory/3208-90-0x0000000007AF0000-0x0000000007B0A000-memory.dmpFilesize
104KB
-
memory/3208-82-0x0000000007DF0000-0x000000000846A000-memory.dmpFilesize
6.5MB
-
memory/3208-85-0x0000000007A30000-0x0000000007AC6000-memory.dmpFilesize
600KB
-
memory/3208-57-0x0000000071090000-0x00000000710DC000-memory.dmpFilesize
304KB
-
memory/3208-91-0x0000000007AD0000-0x0000000007AD8000-memory.dmpFilesize
32KB
-
memory/3208-86-0x00000000079B0000-0x00000000079C1000-memory.dmpFilesize
68KB
-
memory/3208-55-0x0000000002BE0000-0x0000000002BF0000-memory.dmpFilesize
64KB
-
memory/3208-46-0x0000000005FA0000-0x00000000062F4000-memory.dmpFilesize
3.3MB
-
memory/3208-88-0x00000000079E0000-0x00000000079EE000-memory.dmpFilesize
56KB
-
memory/3912-47-0x0000000005B30000-0x0000000005B40000-memory.dmpFilesize
64KB
-
memory/3912-2-0x0000000005F00000-0x00000000064A4000-memory.dmpFilesize
5.6MB
-
memory/3912-3-0x0000000005860000-0x00000000058F2000-memory.dmpFilesize
584KB
-
memory/3912-49-0x00000000749C0000-0x0000000075170000-memory.dmpFilesize
7.7MB
-
memory/3912-1-0x00000000749C0000-0x0000000075170000-memory.dmpFilesize
7.7MB
-
memory/3912-9-0x0000000006F90000-0x0000000007012000-memory.dmpFilesize
520KB
-
memory/3912-4-0x0000000005B30000-0x0000000005B40000-memory.dmpFilesize
64KB
-
memory/3912-5-0x0000000005920000-0x000000000592A000-memory.dmpFilesize
40KB
-
memory/3912-6-0x0000000005B40000-0x0000000005BDC000-memory.dmpFilesize
624KB
-
memory/3912-21-0x00000000749C0000-0x0000000075170000-memory.dmpFilesize
7.7MB
-
memory/3912-7-0x00000000059F0000-0x0000000005A02000-memory.dmpFilesize
72KB
-
memory/3912-8-0x0000000005B10000-0x0000000005B1C000-memory.dmpFilesize
48KB
-
memory/3912-0-0x0000000000F20000-0x0000000000FC8000-memory.dmpFilesize
672KB
-
memory/4952-16-0x0000000005220000-0x0000000005230000-memory.dmpFilesize
64KB
-
memory/4952-58-0x00000000749C0000-0x0000000075170000-memory.dmpFilesize
7.7MB
-
memory/4952-83-0x0000000007960000-0x000000000797A000-memory.dmpFilesize
104KB
-
memory/4952-70-0x000000007FD40000-0x000000007FD50000-memory.dmpFilesize
64KB
-
memory/4952-59-0x0000000071090000-0x00000000710DC000-memory.dmpFilesize
304KB
-
memory/4952-56-0x0000000006C00000-0x0000000006C32000-memory.dmpFilesize
200KB
-
memory/4952-54-0x0000000005220000-0x0000000005230000-memory.dmpFilesize
64KB
-
memory/4952-53-0x0000000006990000-0x00000000069DC000-memory.dmpFilesize
304KB
-
memory/4952-89-0x0000000007BA0000-0x0000000007BB4000-memory.dmpFilesize
80KB
-
memory/4952-52-0x0000000006630000-0x000000000664E000-memory.dmpFilesize
120KB
-
memory/4952-41-0x0000000006110000-0x0000000006176000-memory.dmpFilesize
408KB
-
memory/4952-35-0x0000000005F30000-0x0000000005F96000-memory.dmpFilesize
408KB
-
memory/4952-18-0x0000000005220000-0x0000000005230000-memory.dmpFilesize
64KB
-
memory/4952-97-0x00000000749C0000-0x0000000075170000-memory.dmpFilesize
7.7MB
-
memory/4952-17-0x0000000005860000-0x0000000005E88000-memory.dmpFilesize
6.2MB
-
memory/4952-15-0x00000000749C0000-0x0000000075170000-memory.dmpFilesize
7.7MB
-
memory/4952-14-0x0000000002D00000-0x0000000002D36000-memory.dmpFilesize
216KB