Analysis
-
max time kernel
114s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2024 02:39
Static task
static1
Behavioral task
behavioral1
Sample
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe
Resource
win10v2004-20240226-en
General
-
Target
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe
-
Size
611KB
-
MD5
bb890594548df51e5957ca2445cd7fb8
-
SHA1
7aabf17acfff6e33ef68bbccea7b266a48205fff
-
SHA256
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e
-
SHA512
feaa88044792da5886b7fb4cf7eb4d67ca7be07b2376ae0e5d980be69c873f52db45eef9ab1e4b97f6dc9c1d99350fbbc579462bad7cb5bed49cbdb9752cd022
-
SSDEEP
12288:4SMpPbU8sOUVVhUF+i1c/OGNX+jkniNzXNDu8Z2RjbY8rk45az:4/pPbrUVo+sGNXPiN8W25YqtE
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
Processes:
resource yara_rule behavioral2/memory/912-14-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
Processes:
resource yara_rule behavioral2/memory/912-14-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables packed with or use KoiVM 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1912-3-0x0000023A6C8E0000-0x0000023A6C976000-memory.dmp INDICATOR_EXE_Packed_KoiVM -
Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/912-14-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/912-14-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/912-14-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/912-14-0x0000000000400000-0x0000000000440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 3868 svchost.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\"" ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
svchost.exedescription pid process target process PID 3868 set thread context of 912 3868 svchost.exe regasm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4812 timeout.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exeregasm.exepid process 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 912 regasm.exe 912 regasm.exe 912 regasm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exesvchost.exeregasm.exedescription pid process Token: SeDebugPrivilege 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe Token: SeDebugPrivilege 3868 svchost.exe Token: SeDebugPrivilege 912 regasm.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.execmd.execmd.exesvchost.exedescription pid process target process PID 1912 wrote to memory of 1104 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe cmd.exe PID 1912 wrote to memory of 1104 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe cmd.exe PID 1912 wrote to memory of 800 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe cmd.exe PID 1912 wrote to memory of 800 1912 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe cmd.exe PID 800 wrote to memory of 4812 800 cmd.exe timeout.exe PID 800 wrote to memory of 4812 800 cmd.exe timeout.exe PID 1104 wrote to memory of 1980 1104 cmd.exe schtasks.exe PID 1104 wrote to memory of 1980 1104 cmd.exe schtasks.exe PID 800 wrote to memory of 3868 800 cmd.exe svchost.exe PID 800 wrote to memory of 3868 800 cmd.exe svchost.exe PID 3868 wrote to memory of 3884 3868 svchost.exe installutil.exe PID 3868 wrote to memory of 3884 3868 svchost.exe installutil.exe PID 3868 wrote to memory of 3884 3868 svchost.exe installutil.exe PID 3868 wrote to memory of 912 3868 svchost.exe regasm.exe PID 3868 wrote to memory of 912 3868 svchost.exe regasm.exe PID 3868 wrote to memory of 912 3868 svchost.exe regasm.exe PID 3868 wrote to memory of 912 3868 svchost.exe regasm.exe PID 3868 wrote to memory of 912 3868 svchost.exe regasm.exe PID 3868 wrote to memory of 912 3868 svchost.exe regasm.exe PID 3868 wrote to memory of 912 3868 svchost.exe regasm.exe PID 3868 wrote to memory of 912 3868 svchost.exe regasm.exe PID 3868 wrote to memory of 2044 3868 svchost.exe regasm.exe PID 3868 wrote to memory of 2044 3868 svchost.exe regasm.exe PID 3868 wrote to memory of 2044 3868 svchost.exe regasm.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe"C:\Users\Admin\AppData\Local\Temp\ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6E98.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1304 --field-trial-handle=2256,i,18272763564106695635,11201593968620719822,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6E98.tmp.batFilesize
151B
MD54d8fefc6017d7c2cd27a0fc398df980e
SHA13feb6cc125dd7e83a600ff6b7b74ce599d39be03
SHA256e1f3b6fd1dbd3051f5d90608730b15ebdc6f05ccb6ed2562756484698b5c7631
SHA5122b3cf9d270c525236faf7a19aa4d1eaaad795068716deb50f2c625b4b5317f37da40ffb8a5fdc9fe975db40dbf8e623d2a23353aed3d2fd20d8a7631868d27cf
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
611KB
MD5bb890594548df51e5957ca2445cd7fb8
SHA17aabf17acfff6e33ef68bbccea7b266a48205fff
SHA256ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e
SHA512feaa88044792da5886b7fb4cf7eb4d67ca7be07b2376ae0e5d980be69c873f52db45eef9ab1e4b97f6dc9c1d99350fbbc579462bad7cb5bed49cbdb9752cd022
-
memory/912-21-0x0000000006330000-0x0000000006380000-memory.dmpFilesize
320KB
-
memory/912-18-0x0000000005390000-0x00000000053A0000-memory.dmpFilesize
64KB
-
memory/912-22-0x0000000006420000-0x00000000064B2000-memory.dmpFilesize
584KB
-
memory/912-20-0x0000000005560000-0x00000000055C6000-memory.dmpFilesize
408KB
-
memory/912-24-0x0000000074620000-0x0000000074DD0000-memory.dmpFilesize
7.7MB
-
memory/912-23-0x00000000063B0000-0x00000000063BA000-memory.dmpFilesize
40KB
-
memory/912-14-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/912-15-0x0000000074620000-0x0000000074DD0000-memory.dmpFilesize
7.7MB
-
memory/912-16-0x0000000005A10000-0x0000000005FB4000-memory.dmpFilesize
5.6MB
-
memory/912-25-0x0000000005390000-0x00000000053A0000-memory.dmpFilesize
64KB
-
memory/1912-3-0x0000023A6C8E0000-0x0000023A6C976000-memory.dmpFilesize
600KB
-
memory/1912-1-0x00007FF858720000-0x00007FF8591E1000-memory.dmpFilesize
10.8MB
-
memory/1912-9-0x00007FF858720000-0x00007FF8591E1000-memory.dmpFilesize
10.8MB
-
memory/1912-0-0x0000023A6A0D0000-0x0000023A6A0DC000-memory.dmpFilesize
48KB
-
memory/1912-2-0x0000023A6C5C0000-0x0000023A6C5D0000-memory.dmpFilesize
64KB
-
memory/3868-13-0x00007FF857D90000-0x00007FF858851000-memory.dmpFilesize
10.8MB
-
memory/3868-19-0x00007FF857D90000-0x00007FF858851000-memory.dmpFilesize
10.8MB
-
memory/3868-17-0x000002C13E600000-0x000002C13E7A9000-memory.dmpFilesize
1.7MB