Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 14:00
Static task
static1
Behavioral task
behavioral1
Sample
KhT.scr.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
KhT.scr.exe
Resource
win10v2004-20240319-en
General
-
Target
KhT.scr.exe
-
Size
687KB
-
MD5
62ed0ee9372f04bd637e3995624dbc0c
-
SHA1
96e4d381325b9c0a0581993529baf0cb38050faf
-
SHA256
17f1c3567b5334eca6e41e7a341faa999fdb22f64004a185874e23dd4a43d06d
-
SHA512
7e3c79a487e8d472947aab1050db828ae7fe65ae1af049c00dfe7cd1b4668313665dd6380a32b7465a16da292e8270e53c35586ea39dcef3ec50ddc8a1bd2e1a
-
SSDEEP
12288:4/K0YOwqOpWXqqfNg3Hsgtwmq+MzaMl7+fpfKIIP9HJYxbd:DO7rXHNg3HsgtwD+MzplCfxKzHJI
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.sigmamotorspk.com - Port:
587 - Username:
khiro@sigmamotorspk.com - Password:
zarbeazab1234 - Email To:
maungth@b-mech.com.sg
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
KhT.scr.exedescription pid process target process PID 1220 set thread context of 1844 1220 KhT.scr.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
KhT.scr.exeRegSvcs.exepowershell.exepid process 1220 KhT.scr.exe 1220 KhT.scr.exe 1220 KhT.scr.exe 1220 KhT.scr.exe 1220 KhT.scr.exe 1220 KhT.scr.exe 1220 KhT.scr.exe 1220 KhT.scr.exe 1220 KhT.scr.exe 1220 KhT.scr.exe 1220 KhT.scr.exe 1220 KhT.scr.exe 1220 KhT.scr.exe 1220 KhT.scr.exe 1220 KhT.scr.exe 1220 KhT.scr.exe 1844 RegSvcs.exe 1844 RegSvcs.exe 2512 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
KhT.scr.exeRegSvcs.exepowershell.exedescription pid process Token: SeDebugPrivilege 1220 KhT.scr.exe Token: SeDebugPrivilege 1844 RegSvcs.exe Token: SeDebugPrivilege 2512 powershell.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
KhT.scr.exedescription pid process target process PID 1220 wrote to memory of 2512 1220 KhT.scr.exe powershell.exe PID 1220 wrote to memory of 2512 1220 KhT.scr.exe powershell.exe PID 1220 wrote to memory of 2512 1220 KhT.scr.exe powershell.exe PID 1220 wrote to memory of 2512 1220 KhT.scr.exe powershell.exe PID 1220 wrote to memory of 2660 1220 KhT.scr.exe schtasks.exe PID 1220 wrote to memory of 2660 1220 KhT.scr.exe schtasks.exe PID 1220 wrote to memory of 2660 1220 KhT.scr.exe schtasks.exe PID 1220 wrote to memory of 2660 1220 KhT.scr.exe schtasks.exe PID 1220 wrote to memory of 2448 1220 KhT.scr.exe RegSvcs.exe PID 1220 wrote to memory of 2448 1220 KhT.scr.exe RegSvcs.exe PID 1220 wrote to memory of 2448 1220 KhT.scr.exe RegSvcs.exe PID 1220 wrote to memory of 2448 1220 KhT.scr.exe RegSvcs.exe PID 1220 wrote to memory of 2448 1220 KhT.scr.exe RegSvcs.exe PID 1220 wrote to memory of 2448 1220 KhT.scr.exe RegSvcs.exe PID 1220 wrote to memory of 2448 1220 KhT.scr.exe RegSvcs.exe PID 1220 wrote to memory of 1844 1220 KhT.scr.exe RegSvcs.exe PID 1220 wrote to memory of 1844 1220 KhT.scr.exe RegSvcs.exe PID 1220 wrote to memory of 1844 1220 KhT.scr.exe RegSvcs.exe PID 1220 wrote to memory of 1844 1220 KhT.scr.exe RegSvcs.exe PID 1220 wrote to memory of 1844 1220 KhT.scr.exe RegSvcs.exe PID 1220 wrote to memory of 1844 1220 KhT.scr.exe RegSvcs.exe PID 1220 wrote to memory of 1844 1220 KhT.scr.exe RegSvcs.exe PID 1220 wrote to memory of 1844 1220 KhT.scr.exe RegSvcs.exe PID 1220 wrote to memory of 1844 1220 KhT.scr.exe RegSvcs.exe PID 1220 wrote to memory of 1844 1220 KhT.scr.exe RegSvcs.exe PID 1220 wrote to memory of 1844 1220 KhT.scr.exe RegSvcs.exe PID 1220 wrote to memory of 1844 1220 KhT.scr.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\KhT.scr.exe"C:\Users\Admin\AppData\Local\Temp\KhT.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zTmBkRpHGbA.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zTmBkRpHGbA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA67C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA67C.tmpFilesize
1KB
MD5c80aa23d1ca3e1b8b06de94500a0754d
SHA189504faece1cd3e3377ba54a4ab7a8f5e175cbd2
SHA256ba066af780a572d9b250dc20e63547415c921491bb2b5b086905fefe4c6d5ab4
SHA512fd069f66fea84bd3945827a7cddbffd5aec6a16aa6e2504e49f9e9cf1a999818f1ff6bfea779963f519c78f748f27e0e4670d15cd97c70f524207fab1c234ef3
-
memory/1220-0-0x0000000000E80000-0x0000000000F32000-memory.dmpFilesize
712KB
-
memory/1220-1-0x0000000074B10000-0x00000000751FE000-memory.dmpFilesize
6.9MB
-
memory/1220-2-0x0000000000BB0000-0x0000000000BF0000-memory.dmpFilesize
256KB
-
memory/1220-3-0x0000000000440000-0x000000000045A000-memory.dmpFilesize
104KB
-
memory/1220-4-0x00000000002D0000-0x00000000002DC000-memory.dmpFilesize
48KB
-
memory/1220-5-0x0000000005120000-0x00000000051A2000-memory.dmpFilesize
520KB
-
memory/1220-6-0x0000000074B10000-0x00000000751FE000-memory.dmpFilesize
6.9MB
-
memory/1220-25-0x0000000074B10000-0x00000000751FE000-memory.dmpFilesize
6.9MB
-
memory/1844-15-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1844-29-0x0000000074B10000-0x00000000751FE000-memory.dmpFilesize
6.9MB
-
memory/1844-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1844-17-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1844-22-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1844-24-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1844-16-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1844-33-0x0000000074B10000-0x00000000751FE000-memory.dmpFilesize
6.9MB
-
memory/1844-32-0x0000000004AE0000-0x0000000004B20000-memory.dmpFilesize
256KB
-
memory/1844-28-0x0000000004AE0000-0x0000000004B20000-memory.dmpFilesize
256KB
-
memory/1844-20-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2512-30-0x0000000002700000-0x0000000002740000-memory.dmpFilesize
256KB
-
memory/2512-31-0x000000006EFA0000-0x000000006F54B000-memory.dmpFilesize
5.7MB
-
memory/2512-27-0x000000006EFA0000-0x000000006F54B000-memory.dmpFilesize
5.7MB
-
memory/2512-26-0x000000006EFA0000-0x000000006F54B000-memory.dmpFilesize
5.7MB