Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 02:28
Static task
static1
Behavioral task
behavioral1
Sample
922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
Resource
win10v2004-20240226-en
General
-
Target
922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
-
Size
728KB
-
MD5
339649aa12a77cfcc09c7b07fc9d7f52
-
SHA1
038ef4d52e2553340063d713660a1c4aa1fb7619
-
SHA256
922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef
-
SHA512
c329d09e06adf39e27ea380ada1913ecf3ef4211c3edcd1f3c1515f55fc0e9360e256efe7f1adc57852e56905e0376b61c87151e543bf8461e2e12c5d52196c2
-
SSDEEP
12288:3JglQx+3ZRl5RY4btD+K5t7UQC4u88ildNMPbUrpOwD4muneIjRxmL87vWX1pfSf:ZpxQRhtV88dgbUdOwTunGL8j15ya0M
Malware Config
Extracted
Protocol: smtp- Host:
mail.itresinc.com - Port:
587 - Username:
investorwithkarlee@itresinc.com - Password:
MT]ANFjWzKTA
Extracted
agenttesla
Protocol: smtp- Host:
mail.itresinc.com - Port:
587 - Username:
investorwithkarlee@itresinc.com - Password:
MT]ANFjWzKTA - Email To:
obtxxxtf@gmail.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
Processes:
resource yara_rule behavioral2/memory/464-26-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
Processes:
resource yara_rule behavioral2/memory/464-26-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables packed with SmartAssembly 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4540-9-0x0000000007ED0000-0x0000000007EDC000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly -
Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/464-26-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/464-26-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/464-26-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/464-26-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 42 api.ipify.org 43 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exedescription pid process target process PID 4540 set thread context of 464 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exepowershell.exepowershell.exe922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exepid process 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe 4416 powershell.exe 4416 powershell.exe 1428 powershell.exe 1428 powershell.exe 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe 464 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe 464 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe 464 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe 1428 powershell.exe 4416 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exepowershell.exepowershell.exe922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exedescription pid process Token: SeDebugPrivilege 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe Token: SeDebugPrivilege 1428 powershell.exe Token: SeDebugPrivilege 4416 powershell.exe Token: SeDebugPrivilege 464 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exedescription pid process target process PID 4540 wrote to memory of 4416 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe powershell.exe PID 4540 wrote to memory of 4416 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe powershell.exe PID 4540 wrote to memory of 4416 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe powershell.exe PID 4540 wrote to memory of 1428 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe powershell.exe PID 4540 wrote to memory of 1428 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe powershell.exe PID 4540 wrote to memory of 1428 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe powershell.exe PID 4540 wrote to memory of 4436 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe schtasks.exe PID 4540 wrote to memory of 4436 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe schtasks.exe PID 4540 wrote to memory of 4436 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe schtasks.exe PID 4540 wrote to memory of 464 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe PID 4540 wrote to memory of 464 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe PID 4540 wrote to memory of 464 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe PID 4540 wrote to memory of 464 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe PID 4540 wrote to memory of 464 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe PID 4540 wrote to memory of 464 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe PID 4540 wrote to memory of 464 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe PID 4540 wrote to memory of 464 4540 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe"C:\Users\Admin\AppData\Local\Temp\922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TQUDbFDZarHZ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TQUDbFDZarHZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4E88.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe"C:\Users\Admin\AppData\Local\Temp\922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5a923eeb1d6e6c4d633a8cf91e52f9492
SHA1e2cc3f251419b309f56aa8627e54dcdabafb9723
SHA256a36bfbc20f9afa7bd640b0a31832dee57744286a404292b318fa253055c492ae
SHA512e15cea3ef0a14a54b648e6d9c1ee7bae6f5526ad019be44f77d49c92347160a7bad10feb285975edffd0401a88d82e321b3a0daeb0e5a8ab3f4f8fb95baa8340
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5vn2num5.qdh.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp4E88.tmpFilesize
1KB
MD5e4e605e3ec062b101b0162bf90a39ee2
SHA1e929b92149fea495f89b2fef6fbb1b2afa29eda1
SHA256a496d4b62686356a947dd0d00f8da0e559d85ae509a10153eb756813d40d279f
SHA51292e7a8af7a3251579e88fcd7a4e38daa1c1b8b8f01feba0f937406a01b3436ef754508fed9e3de0bb091a0aba9efa4145b448fd83b743c98708cc35f8d9a3944
-
memory/464-96-0x0000000005440000-0x0000000005450000-memory.dmpFilesize
64KB
-
memory/464-95-0x00000000752D0000-0x0000000075A80000-memory.dmpFilesize
7.7MB
-
memory/464-84-0x0000000006AE0000-0x0000000006B30000-memory.dmpFilesize
320KB
-
memory/464-47-0x0000000005440000-0x0000000005450000-memory.dmpFilesize
64KB
-
memory/464-35-0x00000000752D0000-0x0000000075A80000-memory.dmpFilesize
7.7MB
-
memory/464-26-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1428-80-0x0000000007480000-0x000000000749A000-memory.dmpFilesize
104KB
-
memory/1428-51-0x0000000006160000-0x000000000617E000-memory.dmpFilesize
120KB
-
memory/1428-94-0x00000000752D0000-0x0000000075A80000-memory.dmpFilesize
7.7MB
-
memory/1428-88-0x00000000077A0000-0x00000000077A8000-memory.dmpFilesize
32KB
-
memory/1428-87-0x00000000077C0000-0x00000000077DA000-memory.dmpFilesize
104KB
-
memory/1428-86-0x00000000076C0000-0x00000000076D4000-memory.dmpFilesize
80KB
-
memory/1428-83-0x0000000006710000-0x0000000006721000-memory.dmpFilesize
68KB
-
memory/1428-82-0x0000000007700000-0x0000000007796000-memory.dmpFilesize
600KB
-
memory/1428-21-0x00000000752D0000-0x0000000075A80000-memory.dmpFilesize
7.7MB
-
memory/1428-22-0x0000000004CE0000-0x0000000004CF0000-memory.dmpFilesize
64KB
-
memory/1428-23-0x0000000004CE0000-0x0000000004CF0000-memory.dmpFilesize
64KB
-
memory/1428-78-0x0000000007360000-0x0000000007403000-memory.dmpFilesize
652KB
-
memory/1428-69-0x0000000004E80000-0x0000000004E9E000-memory.dmpFilesize
120KB
-
memory/1428-57-0x0000000071640000-0x000000007168C000-memory.dmpFilesize
304KB
-
memory/1428-55-0x000000007F100000-0x000000007F110000-memory.dmpFilesize
64KB
-
memory/1428-34-0x0000000005B20000-0x0000000005B86000-memory.dmpFilesize
408KB
-
memory/1428-27-0x0000000005A40000-0x0000000005AA6000-memory.dmpFilesize
408KB
-
memory/4416-25-0x00000000061C0000-0x00000000061E2000-memory.dmpFilesize
136KB
-
memory/4416-85-0x0000000007EE0000-0x0000000007EEE000-memory.dmpFilesize
56KB
-
memory/4416-93-0x00000000752D0000-0x0000000075A80000-memory.dmpFilesize
7.7MB
-
memory/4416-16-0x00000000053B0000-0x00000000053E6000-memory.dmpFilesize
216KB
-
memory/4416-52-0x0000000006A00000-0x0000000006A4C000-memory.dmpFilesize
304KB
-
memory/4416-53-0x0000000005410000-0x0000000005420000-memory.dmpFilesize
64KB
-
memory/4416-54-0x000000007F8D0000-0x000000007F8E0000-memory.dmpFilesize
64KB
-
memory/4416-17-0x00000000752D0000-0x0000000075A80000-memory.dmpFilesize
7.7MB
-
memory/4416-18-0x0000000005410000-0x0000000005420000-memory.dmpFilesize
64KB
-
memory/4416-56-0x0000000007960000-0x0000000007992000-memory.dmpFilesize
200KB
-
memory/4416-63-0x0000000071640000-0x000000007168C000-memory.dmpFilesize
304KB
-
memory/4416-20-0x0000000005A50000-0x0000000006078000-memory.dmpFilesize
6.2MB
-
memory/4416-81-0x0000000007D20000-0x0000000007D2A000-memory.dmpFilesize
40KB
-
memory/4416-79-0x0000000008310000-0x000000000898A000-memory.dmpFilesize
6.5MB
-
memory/4540-8-0x0000000007EC0000-0x0000000007ED2000-memory.dmpFilesize
72KB
-
memory/4540-0-0x00000000752D0000-0x0000000075A80000-memory.dmpFilesize
7.7MB
-
memory/4540-10-0x00000000082B0000-0x0000000008334000-memory.dmpFilesize
528KB
-
memory/4540-19-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/4540-4-0x0000000004F80000-0x00000000052D4000-memory.dmpFilesize
3.3MB
-
memory/4540-5-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/4540-9-0x0000000007ED0000-0x0000000007EDC000-memory.dmpFilesize
48KB
-
memory/4540-7-0x0000000007F60000-0x0000000007FFC000-memory.dmpFilesize
624KB
-
memory/4540-46-0x00000000752D0000-0x0000000075A80000-memory.dmpFilesize
7.7MB
-
memory/4540-3-0x0000000004E10000-0x0000000004EA2000-memory.dmpFilesize
584KB
-
memory/4540-6-0x0000000004F00000-0x0000000004F0A000-memory.dmpFilesize
40KB
-
memory/4540-11-0x00000000752D0000-0x0000000075A80000-memory.dmpFilesize
7.7MB
-
memory/4540-2-0x00000000053C0000-0x0000000005964000-memory.dmpFilesize
5.6MB
-
memory/4540-1-0x0000000000350000-0x000000000040A000-memory.dmpFilesize
744KB