Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 02:29
Static task
static1
Behavioral task
behavioral1
Sample
9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe
Resource
win10v2004-20240319-en
General
-
Target
9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe
-
Size
668KB
-
MD5
b2ebfbb63f7ccdff15e24e4ff801c986
-
SHA1
584079acf1abc206fca557907ab0c258ebc21a9a
-
SHA256
9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7
-
SHA512
dd8d4b655504786999696f2603b915351d2daab578568f8ea181fdb54aa5eb420d2f02937eab6d6649562c243bba5259d26e04a19a0c48b894037a66dc48afe2
-
SSDEEP
12288:zuLD9C9DaFlVqcwO9kuereZz5WgZtjs1Ux6xdE0Is0JAIActwqk67tjbFRU:zsuMA7O9nZQktjs1+ps0CI1Ox6nRU
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
royallog@fibraunollc.top - Password:
7213575aceACE@#$ - Email To:
royal@fibraunollc.top
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2676-27-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2676-25-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2676-30-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2676-34-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2676-32-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2676-27-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2676-25-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2676-30-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2676-34-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2676-32-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables packed with or use KoiVM 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2380-3-0x000000001ACD0000-0x000000001AD64000-memory.dmp INDICATOR_EXE_Packed_KoiVM -
Detects executables referencing Windows vault credential objects. Observed in infostealers 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2676-27-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2676-25-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2676-30-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2676-34-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2676-32-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2676-27-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2676-25-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2676-30-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2676-34-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2676-32-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2676-27-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2676-25-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2676-30-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2676-34-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2676-32-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2676-27-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2676-25-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2676-30-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2676-34-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2676-32-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2992 svchost.exe -
Loads dropped DLL 6 IoCs
Processes:
cmd.exeWerFault.exepid process 2588 cmd.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe 2464 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\"" 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
svchost.exedescription pid process target process PID 2992 set thread context of 2676 2992 svchost.exe CasPol.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2656 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exesvchost.exepid process 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exesvchost.exeCasPol.exedescription pid process Token: SeDebugPrivilege 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe Token: SeDebugPrivilege 2992 svchost.exe Token: SeDebugPrivilege 2676 CasPol.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.execmd.execmd.exesvchost.exedescription pid process target process PID 2380 wrote to memory of 2648 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe cmd.exe PID 2380 wrote to memory of 2648 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe cmd.exe PID 2380 wrote to memory of 2648 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe cmd.exe PID 2380 wrote to memory of 2588 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe cmd.exe PID 2380 wrote to memory of 2588 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe cmd.exe PID 2380 wrote to memory of 2588 2380 9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe cmd.exe PID 2648 wrote to memory of 2692 2648 cmd.exe schtasks.exe PID 2648 wrote to memory of 2692 2648 cmd.exe schtasks.exe PID 2648 wrote to memory of 2692 2648 cmd.exe schtasks.exe PID 2588 wrote to memory of 2656 2588 cmd.exe timeout.exe PID 2588 wrote to memory of 2656 2588 cmd.exe timeout.exe PID 2588 wrote to memory of 2656 2588 cmd.exe timeout.exe PID 2588 wrote to memory of 2992 2588 cmd.exe svchost.exe PID 2588 wrote to memory of 2992 2588 cmd.exe svchost.exe PID 2588 wrote to memory of 2992 2588 cmd.exe svchost.exe PID 2992 wrote to memory of 2676 2992 svchost.exe CasPol.exe PID 2992 wrote to memory of 2676 2992 svchost.exe CasPol.exe PID 2992 wrote to memory of 2676 2992 svchost.exe CasPol.exe PID 2992 wrote to memory of 2676 2992 svchost.exe CasPol.exe PID 2992 wrote to memory of 2676 2992 svchost.exe CasPol.exe PID 2992 wrote to memory of 2676 2992 svchost.exe CasPol.exe PID 2992 wrote to memory of 2676 2992 svchost.exe CasPol.exe PID 2992 wrote to memory of 2676 2992 svchost.exe CasPol.exe PID 2992 wrote to memory of 2676 2992 svchost.exe CasPol.exe PID 2992 wrote to memory of 2464 2992 svchost.exe WerFault.exe PID 2992 wrote to memory of 2464 2992 svchost.exe WerFault.exe PID 2992 wrote to memory of 2464 2992 svchost.exe WerFault.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe"C:\Users\Admin\AppData\Local\Temp\9b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1796.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2992 -s 7284⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1796.tmp.batFilesize
151B
MD55569f470b6e61f865593b89b1a47d25d
SHA1af52db10f4f30e0ab44a78a908551ed0dbfa3e51
SHA256f65cb4a44a56d63a84341b0402e7ca7082578379e9b39fc150f33e61bf13098f
SHA5127350c1bfce4b591b5cc6ebc767a7c939940f21fb45f61fbf553ded8e39f83993454b89b58c478c1ce53f357e36222c75401227d5dc1cb80c0a6fde313a62da91
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
668KB
MD5b2ebfbb63f7ccdff15e24e4ff801c986
SHA1584079acf1abc206fca557907ab0c258ebc21a9a
SHA2569b6287ed088ca9a4d43602c95f045bafb0f17214412a749d27a5b2c126c8edb7
SHA512dd8d4b655504786999696f2603b915351d2daab578568f8ea181fdb54aa5eb420d2f02937eab6d6649562c243bba5259d26e04a19a0c48b894037a66dc48afe2
-
memory/2380-0-0x00000000013E0000-0x00000000013FA000-memory.dmpFilesize
104KB
-
memory/2380-1-0x000007FEF5830000-0x000007FEF621C000-memory.dmpFilesize
9.9MB
-
memory/2380-2-0x000000001B1C0000-0x000000001B240000-memory.dmpFilesize
512KB
-
memory/2380-3-0x000000001ACD0000-0x000000001AD64000-memory.dmpFilesize
592KB
-
memory/2380-13-0x000007FEF5830000-0x000007FEF621C000-memory.dmpFilesize
9.9MB
-
memory/2676-23-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2676-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2676-44-0x0000000074360000-0x0000000074A4E000-memory.dmpFilesize
6.9MB
-
memory/2676-41-0x0000000004990000-0x00000000049D0000-memory.dmpFilesize
256KB
-
memory/2676-27-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2676-25-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2676-21-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2676-40-0x0000000074360000-0x0000000074A4E000-memory.dmpFilesize
6.9MB
-
memory/2676-30-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2676-34-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2676-32-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2992-19-0x000007FEF4E40000-0x000007FEF582C000-memory.dmpFilesize
9.9MB
-
memory/2992-18-0x00000000002A0000-0x00000000002BA000-memory.dmpFilesize
104KB
-
memory/2992-42-0x000007FEF4E40000-0x000007FEF582C000-memory.dmpFilesize
9.9MB
-
memory/2992-43-0x000000001B1A0000-0x000000001B220000-memory.dmpFilesize
512KB
-
memory/2992-20-0x000000001B1A0000-0x000000001B220000-memory.dmpFilesize
512KB