Analysis
-
max time kernel
118s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-03-2024 01:55
Static task
static1
Behavioral task
behavioral1
Sample
ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe
Resource
win10v2004-20240226-en
General
-
Target
ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe
-
Size
810KB
-
MD5
dfa4d69d102efe18603b643e03cd916f
-
SHA1
104857721a2a10211bf4638fc1aac4f01026839d
-
SHA256
ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41
-
SHA512
0e248fc8bbc5db13db05c266b46a0bbd4900de17c5208c881fc66ff0732cd67af50000936da1a1b198fefa9e9407388fdf9ff78116b5b2abdaa02817a67f46fe
-
SSDEEP
12288:GfpsApRsBWD84RF1RSaXXqftMwjfBCQr60ijTLGSCB8rBCg09poeV:GtpRse40MvCVTGhBoCX9
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.kabeercommodities.com - Port:
587 - Username:
[email protected] - Password:
w{A6H.o&sz%g - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exedescription pid process target process PID 1292 set thread context of 2436 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exeae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exepowershell.exepowershell.exepid process 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe 2436 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe 2436 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe 2636 powershell.exe 2564 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exeae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe Token: SeDebugPrivilege 2436 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe Token: SeDebugPrivilege 2636 powershell.exe Token: SeDebugPrivilege 2564 powershell.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exedescription pid process target process PID 1292 wrote to memory of 2564 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe powershell.exe PID 1292 wrote to memory of 2564 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe powershell.exe PID 1292 wrote to memory of 2564 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe powershell.exe PID 1292 wrote to memory of 2564 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe powershell.exe PID 1292 wrote to memory of 2636 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe powershell.exe PID 1292 wrote to memory of 2636 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe powershell.exe PID 1292 wrote to memory of 2636 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe powershell.exe PID 1292 wrote to memory of 2636 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe powershell.exe PID 1292 wrote to memory of 2656 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe schtasks.exe PID 1292 wrote to memory of 2656 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe schtasks.exe PID 1292 wrote to memory of 2656 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe schtasks.exe PID 1292 wrote to memory of 2656 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe schtasks.exe PID 1292 wrote to memory of 2436 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe PID 1292 wrote to memory of 2436 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe PID 1292 wrote to memory of 2436 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe PID 1292 wrote to memory of 2436 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe PID 1292 wrote to memory of 2436 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe PID 1292 wrote to memory of 2436 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe PID 1292 wrote to memory of 2436 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe PID 1292 wrote to memory of 2436 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe PID 1292 wrote to memory of 2436 1292 ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe"C:\Users\Admin\AppData\Local\Temp\ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uhoFDbAUHRPNgj.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uhoFDbAUHRPNgj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC1C9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe"C:\Users\Admin\AppData\Local\Temp\ae7f2736fd9aa11676e139b0d89f702cd2fab6660b9b589c1feddc4898520c41.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC1C9.tmpFilesize
1KB
MD56e847a37d43160ff7d51c9acd78086b8
SHA11d212a752cd463483f0a1709130a3639cd2c46a9
SHA25637a48690de6e9e9c6fce655f8cd5a44266f4f825452cc75b9329375260580ac0
SHA512cc1d5bd8dc9d795cdb63c4a54a8e1423994ffe3257d6dd0ac834af9d344ee320aa013e22d6a470ef24c50fc5e02ddb81bcac4a42ce330e1eda4499e862024e11
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD51ff325c87601d00e4859d7c39dc3b2c3
SHA1c44258e047cc8187189b9cfb45b190161508916b
SHA2566f7c1dcaa996274e1b9464fd61e2e720885d9ffb82335232f31c1dc0b9d6844d
SHA512c40958dadeaee2ff4f98a9dffc3800076cf9e3c4903407bd01262ede094151f0bbdb304b909163a39a0fc667cddcabf4218d07c739d6289617c67f083cd5c616
-
memory/1292-27-0x0000000074B10000-0x00000000751FE000-memory.dmpFilesize
6.9MB
-
memory/1292-3-0x0000000000440000-0x000000000045A000-memory.dmpFilesize
104KB
-
memory/1292-4-0x0000000000460000-0x000000000046C000-memory.dmpFilesize
48KB
-
memory/1292-5-0x0000000005C40000-0x0000000005CC2000-memory.dmpFilesize
520KB
-
memory/1292-2-0x0000000004840000-0x0000000004880000-memory.dmpFilesize
256KB
-
memory/1292-0-0x0000000074B10000-0x00000000751FE000-memory.dmpFilesize
6.9MB
-
memory/1292-1-0x0000000000FC0000-0x0000000001090000-memory.dmpFilesize
832KB
-
memory/2436-18-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2436-19-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2436-21-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2436-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2436-25-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2436-43-0x0000000004A30000-0x0000000004A70000-memory.dmpFilesize
256KB
-
memory/2436-30-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2436-17-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2436-42-0x0000000074B10000-0x00000000751FE000-memory.dmpFilesize
6.9MB
-
memory/2436-28-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2436-36-0x0000000074B10000-0x00000000751FE000-memory.dmpFilesize
6.9MB
-
memory/2564-41-0x000000006F680000-0x000000006FC2B000-memory.dmpFilesize
5.7MB
-
memory/2564-33-0x000000006F680000-0x000000006FC2B000-memory.dmpFilesize
5.7MB
-
memory/2564-39-0x00000000025C0000-0x0000000002600000-memory.dmpFilesize
256KB
-
memory/2564-34-0x000000006F680000-0x000000006FC2B000-memory.dmpFilesize
5.7MB
-
memory/2636-35-0x000000006F680000-0x000000006FC2B000-memory.dmpFilesize
5.7MB
-
memory/2636-37-0x0000000001F50000-0x0000000001F90000-memory.dmpFilesize
256KB
-
memory/2636-38-0x0000000001F50000-0x0000000001F90000-memory.dmpFilesize
256KB
-
memory/2636-40-0x000000006F680000-0x000000006FC2B000-memory.dmpFilesize
5.7MB
-
memory/2636-32-0x0000000001F50000-0x0000000001F90000-memory.dmpFilesize
256KB
-
memory/2636-31-0x000000006F680000-0x000000006FC2B000-memory.dmpFilesize
5.7MB