Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-03-2024 01:08
Static task
static1
Behavioral task
behavioral1
Sample
SATIN ALMA EMRİ_PDF.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SATIN ALMA EMRİ_PDF.exe
Resource
win10v2004-20240226-en
General
-
Target
SATIN ALMA EMRİ_PDF.exe
-
Size
611KB
-
MD5
ff78832074659316429eae05feaed982
-
SHA1
e78bdc8b2f7c475aabc1d06b96739a10374b2879
-
SHA256
efe843e7a38bf867d8229fca37228d00ad7b8c7b6514c9fe7011befe33ba1930
-
SHA512
7936956713fc488d45f1da9ba41a9ef821a6eea142a2814b774cd88c8dd31f1a0ec2cf1498b65193cba313bcffe4a241a80e06bcfcda60bb98ed8dc8557dd296
-
SSDEEP
12288:mWYIwC6yssIj/uoQOKQ1t2sMUB83zBpFxbry63piYb6e6/vutWD:mWYI0Zj/jxd1tPMJ3znr/ybYbevuED
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2684 svchost.exe -
Loads dropped DLL 6 IoCs
Processes:
cmd.exeWerFault.exepid process 2588 cmd.exe 2432 WerFault.exe 2432 WerFault.exe 2432 WerFault.exe 2432 WerFault.exe 2432 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SATIN ALMA EMRİ_PDF.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\"" SATIN ALMA EMRİ_PDF.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
svchost.exedescription pid process target process PID 2684 set thread context of 2400 2684 svchost.exe regsvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2524 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
SATIN ALMA EMRİ_PDF.exeregsvcs.exepid process 1696 SATIN ALMA EMRİ_PDF.exe 1696 SATIN ALMA EMRİ_PDF.exe 2400 regsvcs.exe 2400 regsvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SATIN ALMA EMRİ_PDF.exesvchost.exeregsvcs.exedescription pid process Token: SeDebugPrivilege 1696 SATIN ALMA EMRİ_PDF.exe Token: SeDebugPrivilege 2684 svchost.exe Token: SeDebugPrivilege 2400 regsvcs.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
SATIN ALMA EMRİ_PDF.execmd.execmd.exesvchost.exedescription pid process target process PID 1696 wrote to memory of 2496 1696 SATIN ALMA EMRİ_PDF.exe cmd.exe PID 1696 wrote to memory of 2496 1696 SATIN ALMA EMRİ_PDF.exe cmd.exe PID 1696 wrote to memory of 2496 1696 SATIN ALMA EMRİ_PDF.exe cmd.exe PID 1696 wrote to memory of 2588 1696 SATIN ALMA EMRİ_PDF.exe cmd.exe PID 1696 wrote to memory of 2588 1696 SATIN ALMA EMRİ_PDF.exe cmd.exe PID 1696 wrote to memory of 2588 1696 SATIN ALMA EMRİ_PDF.exe cmd.exe PID 2588 wrote to memory of 2524 2588 cmd.exe timeout.exe PID 2588 wrote to memory of 2524 2588 cmd.exe timeout.exe PID 2588 wrote to memory of 2524 2588 cmd.exe timeout.exe PID 2496 wrote to memory of 1980 2496 cmd.exe schtasks.exe PID 2496 wrote to memory of 1980 2496 cmd.exe schtasks.exe PID 2496 wrote to memory of 1980 2496 cmd.exe schtasks.exe PID 2588 wrote to memory of 2684 2588 cmd.exe svchost.exe PID 2588 wrote to memory of 2684 2588 cmd.exe svchost.exe PID 2588 wrote to memory of 2684 2588 cmd.exe svchost.exe PID 2684 wrote to memory of 2400 2684 svchost.exe regsvcs.exe PID 2684 wrote to memory of 2400 2684 svchost.exe regsvcs.exe PID 2684 wrote to memory of 2400 2684 svchost.exe regsvcs.exe PID 2684 wrote to memory of 2400 2684 svchost.exe regsvcs.exe PID 2684 wrote to memory of 2400 2684 svchost.exe regsvcs.exe PID 2684 wrote to memory of 2400 2684 svchost.exe regsvcs.exe PID 2684 wrote to memory of 2400 2684 svchost.exe regsvcs.exe PID 2684 wrote to memory of 2400 2684 svchost.exe regsvcs.exe PID 2684 wrote to memory of 2400 2684 svchost.exe regsvcs.exe PID 2684 wrote to memory of 2400 2684 svchost.exe regsvcs.exe PID 2684 wrote to memory of 2400 2684 svchost.exe regsvcs.exe PID 2684 wrote to memory of 2400 2684 svchost.exe regsvcs.exe PID 2684 wrote to memory of 2432 2684 svchost.exe WerFault.exe PID 2684 wrote to memory of 2432 2684 svchost.exe WerFault.exe PID 2684 wrote to memory of 2432 2684 svchost.exe WerFault.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SATIN ALMA EMRİ_PDF.exe"C:\Users\Admin\AppData\Local\Temp\SATIN ALMA EMRİ_PDF.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp83FF.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2684 -s 7804⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp83FF.tmp.batFilesize
151B
MD553d0e5f50bfacb90b3913a05da561838
SHA19a3f76b4527f4f06766252f52f7126425581706c
SHA256b2b1e2246d46fa5488e1ceaea61ecf9d46a14fbfc39f064c401b92bc11cb02c4
SHA512408b8d196028e849269f570e84e9d2fc2a2d72f36fc69cf517bb556fc4a2d35f98ef30355ccfc8990c3c160a8dd2f64629a0a7f33727e5b7e5a71e38b73357f1
-
\Users\Admin\AppData\Roaming\svchost.exeFilesize
611KB
MD5ff78832074659316429eae05feaed982
SHA1e78bdc8b2f7c475aabc1d06b96739a10374b2879
SHA256efe843e7a38bf867d8229fca37228d00ad7b8c7b6514c9fe7011befe33ba1930
SHA5127936956713fc488d45f1da9ba41a9ef821a6eea142a2814b774cd88c8dd31f1a0ec2cf1498b65193cba313bcffe4a241a80e06bcfcda60bb98ed8dc8557dd296
-
memory/1696-0-0x0000000000910000-0x000000000091C000-memory.dmpFilesize
48KB
-
memory/1696-1-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmpFilesize
9.9MB
-
memory/1696-2-0x000000001B250000-0x000000001B2D0000-memory.dmpFilesize
512KB
-
memory/1696-3-0x000000001B250000-0x000000001B2D0000-memory.dmpFilesize
512KB
-
memory/1696-4-0x000000001B1A0000-0x000000001B236000-memory.dmpFilesize
600KB
-
memory/1696-14-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmpFilesize
9.9MB
-
memory/2400-23-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2400-30-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2400-44-0x0000000074030000-0x000000007471E000-memory.dmpFilesize
6.9MB
-
memory/2400-39-0x0000000074030000-0x000000007471E000-memory.dmpFilesize
6.9MB
-
memory/2400-34-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2400-24-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2400-27-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2400-25-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2400-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2400-32-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2684-21-0x000000001B2D0000-0x000000001B350000-memory.dmpFilesize
512KB
-
memory/2684-19-0x0000000000300000-0x000000000030C000-memory.dmpFilesize
48KB
-
memory/2684-22-0x000000001B2D0000-0x000000001B350000-memory.dmpFilesize
512KB
-
memory/2684-41-0x000007FEF4AA0000-0x000007FEF548C000-memory.dmpFilesize
9.9MB
-
memory/2684-42-0x000000001B2D0000-0x000000001B350000-memory.dmpFilesize
512KB
-
memory/2684-43-0x000000001B2D0000-0x000000001B350000-memory.dmpFilesize
512KB
-
memory/2684-20-0x000007FEF4AA0000-0x000007FEF548C000-memory.dmpFilesize
9.9MB