Analysis
-
max time kernel
146s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2024 01:08
Static task
static1
Behavioral task
behavioral1
Sample
SATIN ALMA EMRİ_PDF.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SATIN ALMA EMRİ_PDF.exe
Resource
win10v2004-20240226-en
General
-
Target
SATIN ALMA EMRİ_PDF.exe
-
Size
611KB
-
MD5
ff78832074659316429eae05feaed982
-
SHA1
e78bdc8b2f7c475aabc1d06b96739a10374b2879
-
SHA256
efe843e7a38bf867d8229fca37228d00ad7b8c7b6514c9fe7011befe33ba1930
-
SHA512
7936956713fc488d45f1da9ba41a9ef821a6eea142a2814b774cd88c8dd31f1a0ec2cf1498b65193cba313bcffe4a241a80e06bcfcda60bb98ed8dc8557dd296
-
SSDEEP
12288:mWYIwC6yssIj/uoQOKQ1t2sMUB83zBpFxbry63piYb6e6/vutWD:mWYI0Zj/jxd1tPMJ3znr/ybYbevuED
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SATIN ALMA EMRİ_PDF.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation SATIN ALMA EMRİ_PDF.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 4780 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SATIN ALMA EMRİ_PDF.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\"" SATIN ALMA EMRİ_PDF.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
svchost.exedescription pid process target process PID 4780 set thread context of 420 4780 svchost.exe msbuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 5096 timeout.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
SATIN ALMA EMRİ_PDF.exemsbuild.exepid process 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 4692 SATIN ALMA EMRİ_PDF.exe 420 msbuild.exe 420 msbuild.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SATIN ALMA EMRİ_PDF.exesvchost.exemsbuild.exedescription pid process Token: SeDebugPrivilege 4692 SATIN ALMA EMRİ_PDF.exe Token: SeDebugPrivilege 4780 svchost.exe Token: SeDebugPrivilege 420 msbuild.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
SATIN ALMA EMRİ_PDF.execmd.execmd.exesvchost.exedescription pid process target process PID 4692 wrote to memory of 2160 4692 SATIN ALMA EMRİ_PDF.exe cmd.exe PID 4692 wrote to memory of 2160 4692 SATIN ALMA EMRİ_PDF.exe cmd.exe PID 4692 wrote to memory of 4340 4692 SATIN ALMA EMRİ_PDF.exe cmd.exe PID 4692 wrote to memory of 4340 4692 SATIN ALMA EMRİ_PDF.exe cmd.exe PID 2160 wrote to memory of 5036 2160 cmd.exe schtasks.exe PID 2160 wrote to memory of 5036 2160 cmd.exe schtasks.exe PID 4340 wrote to memory of 5096 4340 cmd.exe timeout.exe PID 4340 wrote to memory of 5096 4340 cmd.exe timeout.exe PID 4340 wrote to memory of 4780 4340 cmd.exe svchost.exe PID 4340 wrote to memory of 4780 4340 cmd.exe svchost.exe PID 4780 wrote to memory of 428 4780 svchost.exe AddInProcess32.exe PID 4780 wrote to memory of 428 4780 svchost.exe AddInProcess32.exe PID 4780 wrote to memory of 428 4780 svchost.exe AddInProcess32.exe PID 4780 wrote to memory of 420 4780 svchost.exe msbuild.exe PID 4780 wrote to memory of 420 4780 svchost.exe msbuild.exe PID 4780 wrote to memory of 420 4780 svchost.exe msbuild.exe PID 4780 wrote to memory of 420 4780 svchost.exe msbuild.exe PID 4780 wrote to memory of 420 4780 svchost.exe msbuild.exe PID 4780 wrote to memory of 420 4780 svchost.exe msbuild.exe PID 4780 wrote to memory of 420 4780 svchost.exe msbuild.exe PID 4780 wrote to memory of 420 4780 svchost.exe msbuild.exe PID 4780 wrote to memory of 4436 4780 svchost.exe msbuild.exe PID 4780 wrote to memory of 4436 4780 svchost.exe msbuild.exe PID 4780 wrote to memory of 4436 4780 svchost.exe msbuild.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SATIN ALMA EMRİ_PDF.exe"C:\Users\Admin\AppData\Local\Temp\SATIN ALMA EMRİ_PDF.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
PID:5036 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8A10.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:5096 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"4⤵PID:428
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:420 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"4⤵PID:4436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8A10.tmp.batFilesize
151B
MD5c7acb6fe6348959623b6217eb454336d
SHA1931d85966fb8900d0adc5805bdb806c5a90ceb02
SHA256c8cd18b4e89625d0b64a9cc43fd2c32639d92f697f1e6d5bf46e0bef6a808844
SHA512e7a0838f252d77b2ab0e2d2ee9eaa3e58bbdbffebad95f3df60dff8429a4e0d5b3486925fd4a599b2c63d208c9a29dfb9ec0ab06a1c0123899b7da3bb4255d14
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
611KB
MD5ff78832074659316429eae05feaed982
SHA1e78bdc8b2f7c475aabc1d06b96739a10374b2879
SHA256efe843e7a38bf867d8229fca37228d00ad7b8c7b6514c9fe7011befe33ba1930
SHA5127936956713fc488d45f1da9ba41a9ef821a6eea142a2814b774cd88c8dd31f1a0ec2cf1498b65193cba313bcffe4a241a80e06bcfcda60bb98ed8dc8557dd296
-
memory/420-18-0x0000000005BA0000-0x0000000006144000-memory.dmpFilesize
5.6MB
-
memory/420-26-0x00000000054F0000-0x0000000005500000-memory.dmpFilesize
64KB
-
memory/420-25-0x0000000074F70000-0x0000000075720000-memory.dmpFilesize
7.7MB
-
memory/420-24-0x0000000006570000-0x000000000657A000-memory.dmpFilesize
40KB
-
memory/420-23-0x00000000065E0000-0x0000000006672000-memory.dmpFilesize
584KB
-
memory/420-22-0x00000000064F0000-0x0000000006540000-memory.dmpFilesize
320KB
-
memory/420-20-0x0000000005500000-0x0000000005566000-memory.dmpFilesize
408KB
-
memory/420-19-0x00000000054F0000-0x0000000005500000-memory.dmpFilesize
64KB
-
memory/420-16-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/420-17-0x0000000074F70000-0x0000000075720000-memory.dmpFilesize
7.7MB
-
memory/4692-5-0x00000276DA660000-0x00000276DA6F6000-memory.dmpFilesize
600KB
-
memory/4692-11-0x00007FFCA7770000-0x00007FFCA8231000-memory.dmpFilesize
10.8MB
-
memory/4692-0-0x00000276BF0E0000-0x00000276BF0EC000-memory.dmpFilesize
48KB
-
memory/4692-4-0x00000276C0EC0000-0x00000276C0EDE000-memory.dmpFilesize
120KB
-
memory/4692-3-0x00000276DA4E0000-0x00000276DA556000-memory.dmpFilesize
472KB
-
memory/4692-2-0x00000276D9690000-0x00000276D96A0000-memory.dmpFilesize
64KB
-
memory/4692-1-0x00007FFCA7770000-0x00007FFCA8231000-memory.dmpFilesize
10.8MB
-
memory/4780-15-0x00007FFCA7100000-0x00007FFCA7BC1000-memory.dmpFilesize
10.8MB
-
memory/4780-21-0x00007FFCA7100000-0x00007FFCA7BC1000-memory.dmpFilesize
10.8MB