Analysis
-
max time kernel
121s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 02:33
Static task
static1
Behavioral task
behavioral1
Sample
b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe
Resource
win10v2004-20240226-en
General
-
Target
b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe
-
Size
660KB
-
MD5
818c1d4d7b71a802240c5b04010c0929
-
SHA1
21ab4b40707da5ccdadf53c37458cc5b5ea674a7
-
SHA256
b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a
-
SHA512
fb4e9f6eb2b8b4e1f5e9e3b332a3bc40297f69924c60c052632e68ba44e666c2ceea9b5dc2b6aeb0125ebb03b722e5b1668c8ad90618e0a2e96e2c892584892a
-
SSDEEP
12288:aH2iNlw09szFS6U2/fdkuj+JvDUPXn1+hVh7ziEy27/MxC1GKuMDwK5J8XVhB+g:01XKC2XdLj+JLSX1kEE/M4wK/wK5qVH9
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.oceanskylogistics.in - Port:
587 - Username:
export@oceanskylogistics.in - Password:
Oce@n@1234 - Email To:
jose.oliveirea655@gmail.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2196-29-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2196-35-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2196-33-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2196-38-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2196-28-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2196-40-0x0000000004AE0000-0x0000000004B20000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2196-29-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2196-35-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2196-33-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2196-38-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2196-28-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2196-40-0x0000000004AE0000-0x0000000004B20000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables packed with SmartAssembly 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3004-4-0x0000000000610000-0x000000000061C000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly -
Detects executables referencing Windows vault credential objects. Observed in infostealers 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2196-29-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2196-35-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2196-33-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2196-38-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2196-28-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2196-40-0x0000000004AE0000-0x0000000004B20000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2196-29-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2196-35-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2196-33-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2196-38-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2196-28-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2196-40-0x0000000004AE0000-0x0000000004B20000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2196-29-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2196-35-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2196-33-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2196-38-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2196-28-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2196-40-0x0000000004AE0000-0x0000000004B20000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2196-29-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2196-35-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2196-33-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2196-38-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2196-28-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2196-40-0x0000000004AE0000-0x0000000004B20000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\JLfew = "C:\\Users\\Admin\\AppData\\Roaming\\JLfew\\JLfew.exe" RegSvcs.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exedescription pid process target process PID 3004 set thread context of 2196 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exeRegSvcs.exepid process 2848 powershell.exe 2672 powershell.exe 2196 RegSvcs.exe 2196 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2848 powershell.exe Token: SeDebugPrivilege 2672 powershell.exe Token: SeDebugPrivilege 2196 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exedescription pid process target process PID 3004 wrote to memory of 2848 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe powershell.exe PID 3004 wrote to memory of 2848 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe powershell.exe PID 3004 wrote to memory of 2848 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe powershell.exe PID 3004 wrote to memory of 2848 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe powershell.exe PID 3004 wrote to memory of 2672 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe powershell.exe PID 3004 wrote to memory of 2672 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe powershell.exe PID 3004 wrote to memory of 2672 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe powershell.exe PID 3004 wrote to memory of 2672 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe powershell.exe PID 3004 wrote to memory of 2684 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe schtasks.exe PID 3004 wrote to memory of 2684 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe schtasks.exe PID 3004 wrote to memory of 2684 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe schtasks.exe PID 3004 wrote to memory of 2684 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe schtasks.exe PID 3004 wrote to memory of 2196 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 3004 wrote to memory of 2196 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 3004 wrote to memory of 2196 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 3004 wrote to memory of 2196 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 3004 wrote to memory of 2196 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 3004 wrote to memory of 2196 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 3004 wrote to memory of 2196 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 3004 wrote to memory of 2196 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 3004 wrote to memory of 2196 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 3004 wrote to memory of 2196 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 3004 wrote to memory of 2196 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 3004 wrote to memory of 2196 3004 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe"C:\Users\Admin\AppData\Local\Temp\b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uJJKThDIVHPLhE.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uJJKThDIVHPLhE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp901F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp901F.tmpFilesize
1KB
MD5891569d5a23cacaa11548bc6d82ee94f
SHA1a537478b63bd73835f5603e0f1af79d63ad53beb
SHA25650767a9af4996cb7c052e2432ca603b6882cffa357b09bf5398e89c3e283449d
SHA512de5512dcd7c72208b2fc6c4850aaec80b66b311ed1074ac611bf3b1b6e584c9dd75f37d694a7cd8996e163590290c4663bef3169b0740be633dc7b1c7967c913
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DWYIP6N622XLBQT5B22M.tempFilesize
7KB
MD5fc24d9ea072ac85a4e887006df5688db
SHA130262a2000574cacf99b63f39ee3f932bf4908d1
SHA256ff698b2f6900d00359a6a40594dfcf25b8d0e3678b4ab54f3282e5ee93e32caa
SHA5124532750339ed830c8528ff5508439cf86367de2cf0a02ec0e3ece42fc828d72cbb446b1f651bf4e3acd8d45d6be80fb9bff5b53fb59c43b8baf108da07e83951
-
memory/2196-38-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2196-39-0x0000000072A90000-0x000000007317E000-memory.dmpFilesize
6.9MB
-
memory/2196-29-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2196-58-0x0000000072A90000-0x000000007317E000-memory.dmpFilesize
6.9MB
-
memory/2196-25-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2196-40-0x0000000004AE0000-0x0000000004B20000-memory.dmpFilesize
256KB
-
memory/2196-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2196-35-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2196-28-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2196-27-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2196-59-0x0000000004AE0000-0x0000000004B20000-memory.dmpFilesize
256KB
-
memory/2196-33-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2672-22-0x000000006DA40000-0x000000006DFEB000-memory.dmpFilesize
5.7MB
-
memory/2672-41-0x000000006DA40000-0x000000006DFEB000-memory.dmpFilesize
5.7MB
-
memory/2672-18-0x000000006DA40000-0x000000006DFEB000-memory.dmpFilesize
5.7MB
-
memory/2672-24-0x0000000002880000-0x00000000028C0000-memory.dmpFilesize
256KB
-
memory/2848-19-0x000000006DA40000-0x000000006DFEB000-memory.dmpFilesize
5.7MB
-
memory/2848-23-0x00000000028B0000-0x00000000028F0000-memory.dmpFilesize
256KB
-
memory/2848-21-0x000000006DA40000-0x000000006DFEB000-memory.dmpFilesize
5.7MB
-
memory/2848-20-0x00000000028B0000-0x00000000028F0000-memory.dmpFilesize
256KB
-
memory/2848-42-0x000000006DA40000-0x000000006DFEB000-memory.dmpFilesize
5.7MB
-
memory/3004-0-0x0000000000DF0000-0x0000000000E9A000-memory.dmpFilesize
680KB
-
memory/3004-37-0x0000000073F30000-0x000000007461E000-memory.dmpFilesize
6.9MB
-
memory/3004-3-0x0000000000290000-0x00000000002A2000-memory.dmpFilesize
72KB
-
memory/3004-1-0x0000000073F30000-0x000000007461E000-memory.dmpFilesize
6.9MB
-
memory/3004-2-0x0000000004F10000-0x0000000004F50000-memory.dmpFilesize
256KB
-
memory/3004-5-0x0000000005300000-0x0000000005384000-memory.dmpFilesize
528KB
-
memory/3004-4-0x0000000000610000-0x000000000061C000-memory.dmpFilesize
48KB