Analysis
-
max time kernel
117s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 02:37
Static task
static1
Behavioral task
behavioral1
Sample
PO 20240105.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PO 20240105.exe
Resource
win10v2004-20240226-en
General
-
Target
PO 20240105.exe
-
Size
740KB
-
MD5
81d099f1008d98346919c22f105e26e5
-
SHA1
de77e686d32adca574703621974811dc6c7d3b31
-
SHA256
1ddead5d6964c8e382d3b2ea694774ff58486bcfb7996015561cc9a03c61b536
-
SHA512
b174aa74461edcc8afee22134084d6de4001fdf5d7012fbcd904f119d3959d776b43fd91a25147c20d2dcfa0d18eeb0b554155d2c7380d55030e6dd2e28bf794
-
SSDEEP
12288:Wd1JsJ6SH1Sh2iNwCZDcTsTmmk82Zzl2VLlh5AMOYFC6Vljc4J+G30NuqDpfLpPd:Wd4w1GQQABk1Zzl4ph5vtCi0hBDpfLG
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.starmech.net - Port:
587 - Username:
electronics@starmech.net - Password:
nics123 - Email To:
godwingodwin397@gmail.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1100-25-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1100-26-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1100-31-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1100-39-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1100-34-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1100-25-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1100-26-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1100-31-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1100-39-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1100-34-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables packed with SmartAssembly 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2560-4-0x0000000000430000-0x000000000043C000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly -
Detects executables referencing Windows vault credential objects. Observed in infostealers 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1100-25-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1100-26-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1100-31-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1100-39-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1100-34-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1100-25-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1100-26-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1100-31-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1100-39-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1100-34-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1100-25-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1100-26-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1100-31-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1100-39-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1100-34-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1100-25-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1100-26-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1100-31-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1100-39-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1100-34-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO 20240105.exedescription pid process target process PID 2560 set thread context of 1100 2560 PO 20240105.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
PO 20240105.exepowershell.exepowershell.exeRegSvcs.exepid process 2560 PO 20240105.exe 2560 PO 20240105.exe 2560 PO 20240105.exe 2560 PO 20240105.exe 2560 PO 20240105.exe 2560 PO 20240105.exe 2560 PO 20240105.exe 2488 powershell.exe 2384 powershell.exe 2560 PO 20240105.exe 1100 RegSvcs.exe 1100 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PO 20240105.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2560 PO 20240105.exe Token: SeDebugPrivilege 2488 powershell.exe Token: SeDebugPrivilege 2384 powershell.exe Token: SeDebugPrivilege 1100 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
PO 20240105.exedescription pid process target process PID 2560 wrote to memory of 2488 2560 PO 20240105.exe powershell.exe PID 2560 wrote to memory of 2488 2560 PO 20240105.exe powershell.exe PID 2560 wrote to memory of 2488 2560 PO 20240105.exe powershell.exe PID 2560 wrote to memory of 2488 2560 PO 20240105.exe powershell.exe PID 2560 wrote to memory of 2384 2560 PO 20240105.exe powershell.exe PID 2560 wrote to memory of 2384 2560 PO 20240105.exe powershell.exe PID 2560 wrote to memory of 2384 2560 PO 20240105.exe powershell.exe PID 2560 wrote to memory of 2384 2560 PO 20240105.exe powershell.exe PID 2560 wrote to memory of 1900 2560 PO 20240105.exe schtasks.exe PID 2560 wrote to memory of 1900 2560 PO 20240105.exe schtasks.exe PID 2560 wrote to memory of 1900 2560 PO 20240105.exe schtasks.exe PID 2560 wrote to memory of 1900 2560 PO 20240105.exe schtasks.exe PID 2560 wrote to memory of 1100 2560 PO 20240105.exe RegSvcs.exe PID 2560 wrote to memory of 1100 2560 PO 20240105.exe RegSvcs.exe PID 2560 wrote to memory of 1100 2560 PO 20240105.exe RegSvcs.exe PID 2560 wrote to memory of 1100 2560 PO 20240105.exe RegSvcs.exe PID 2560 wrote to memory of 1100 2560 PO 20240105.exe RegSvcs.exe PID 2560 wrote to memory of 1100 2560 PO 20240105.exe RegSvcs.exe PID 2560 wrote to memory of 1100 2560 PO 20240105.exe RegSvcs.exe PID 2560 wrote to memory of 1100 2560 PO 20240105.exe RegSvcs.exe PID 2560 wrote to memory of 1100 2560 PO 20240105.exe RegSvcs.exe PID 2560 wrote to memory of 1100 2560 PO 20240105.exe RegSvcs.exe PID 2560 wrote to memory of 1100 2560 PO 20240105.exe RegSvcs.exe PID 2560 wrote to memory of 1100 2560 PO 20240105.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 20240105.exe"C:\Users\Admin\AppData\Local\Temp\PO 20240105.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO 20240105.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TZgkPJEad.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TZgkPJEad" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5D2D.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5D2D.tmpFilesize
1KB
MD57ac7d20611a325223dc41c19d5ba8632
SHA1863f4ce883217f4f5aca8e30308091864b09cafa
SHA2563230b69535ee32c157f32aef120d7d741c04507c7ab31164e8874888981a6985
SHA5125e63e9705cce5c68970b9f699c91ea80f3ec4beadc535fbfb530c27ce3340165b92855da1f636f29b8b6f8ac4e165d269a734c1e69c1c80cc4ec656a32131ffa
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD51eaee8091237cd44b29eef3821de90fd
SHA175d0bbdb73d9735636908ad192283f83040772a2
SHA2560954f192cf3301ef52d172bcccbdc2870fe856e80982e14e7fa603988baab031
SHA512d40a0f472d98d094aa3f9056869c454e4c64b1fd4ab1ff82e44cb88e34842a51a858c317a1db383c872a0ef25f6d186ce5d9486a4960cded2508ed13c8121acd
-
memory/1100-25-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1100-26-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1100-34-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1100-39-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1100-31-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1100-20-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1100-23-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1100-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2384-37-0x0000000002370000-0x00000000023B0000-memory.dmpFilesize
256KB
-
memory/2384-41-0x000000006FBC0000-0x000000007016B000-memory.dmpFilesize
5.7MB
-
memory/2384-27-0x0000000002370000-0x00000000023B0000-memory.dmpFilesize
256KB
-
memory/2384-33-0x000000006FBC0000-0x000000007016B000-memory.dmpFilesize
5.7MB
-
memory/2384-24-0x000000006FBC0000-0x000000007016B000-memory.dmpFilesize
5.7MB
-
memory/2488-40-0x0000000002050000-0x0000000002090000-memory.dmpFilesize
256KB
-
memory/2488-35-0x0000000002050000-0x0000000002090000-memory.dmpFilesize
256KB
-
memory/2488-30-0x000000006FBC0000-0x000000007016B000-memory.dmpFilesize
5.7MB
-
memory/2488-42-0x000000006FBC0000-0x000000007016B000-memory.dmpFilesize
5.7MB
-
memory/2488-21-0x000000006FBC0000-0x000000007016B000-memory.dmpFilesize
5.7MB
-
memory/2560-19-0x00000000005F0000-0x0000000000630000-memory.dmpFilesize
256KB
-
memory/2560-3-0x0000000000270000-0x0000000000282000-memory.dmpFilesize
72KB
-
memory/2560-18-0x0000000074D30000-0x000000007541E000-memory.dmpFilesize
6.9MB
-
memory/2560-1-0x0000000074D30000-0x000000007541E000-memory.dmpFilesize
6.9MB
-
memory/2560-36-0x0000000074D30000-0x000000007541E000-memory.dmpFilesize
6.9MB
-
memory/2560-4-0x0000000000430000-0x000000000043C000-memory.dmpFilesize
48KB
-
memory/2560-2-0x00000000005F0000-0x0000000000630000-memory.dmpFilesize
256KB
-
memory/2560-5-0x0000000005D00000-0x0000000005D82000-memory.dmpFilesize
520KB
-
memory/2560-0-0x00000000008A0000-0x000000000095C000-memory.dmpFilesize
752KB