Analysis
-
max time kernel
117s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-03-2024 02:24
Static task
static1
Behavioral task
behavioral1
Sample
b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe
Resource
win10v2004-20240226-en
General
-
Target
b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe
-
Size
660KB
-
MD5
818c1d4d7b71a802240c5b04010c0929
-
SHA1
21ab4b40707da5ccdadf53c37458cc5b5ea674a7
-
SHA256
b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a
-
SHA512
fb4e9f6eb2b8b4e1f5e9e3b332a3bc40297f69924c60c052632e68ba44e666c2ceea9b5dc2b6aeb0125ebb03b722e5b1668c8ad90618e0a2e96e2c892584892a
-
SSDEEP
12288:aH2iNlw09szFS6U2/fdkuj+JvDUPXn1+hVh7ziEy27/MxC1GKuMDwK5J8XVhB+g:01XKC2XdLj+JLSX1kEE/M4wK/wK5qVH9
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.oceanskylogistics.in - Port:
587 - Username:
[email protected] - Password:
Oce@n@1234 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\JLfew = "C:\\Users\\Admin\\AppData\\Roaming\\JLfew\\JLfew.exe" RegSvcs.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exedescription pid process target process PID 2232 set thread context of 2448 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exepowershell.exepowershell.exeRegSvcs.exepid process 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe 2640 powershell.exe 2208 powershell.exe 2448 RegSvcs.exe 2448 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe Token: SeDebugPrivilege 2640 powershell.exe Token: SeDebugPrivilege 2208 powershell.exe Token: SeDebugPrivilege 2448 RegSvcs.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exedescription pid process target process PID 2232 wrote to memory of 2208 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe powershell.exe PID 2232 wrote to memory of 2208 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe powershell.exe PID 2232 wrote to memory of 2208 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe powershell.exe PID 2232 wrote to memory of 2208 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe powershell.exe PID 2232 wrote to memory of 2640 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe powershell.exe PID 2232 wrote to memory of 2640 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe powershell.exe PID 2232 wrote to memory of 2640 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe powershell.exe PID 2232 wrote to memory of 2640 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe powershell.exe PID 2232 wrote to memory of 2680 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe schtasks.exe PID 2232 wrote to memory of 2680 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe schtasks.exe PID 2232 wrote to memory of 2680 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe schtasks.exe PID 2232 wrote to memory of 2680 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe schtasks.exe PID 2232 wrote to memory of 2624 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 2232 wrote to memory of 2624 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 2232 wrote to memory of 2624 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 2232 wrote to memory of 2624 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 2232 wrote to memory of 2624 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 2232 wrote to memory of 2624 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 2232 wrote to memory of 2624 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 2232 wrote to memory of 2448 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 2232 wrote to memory of 2448 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 2232 wrote to memory of 2448 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 2232 wrote to memory of 2448 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 2232 wrote to memory of 2448 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 2232 wrote to memory of 2448 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 2232 wrote to memory of 2448 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 2232 wrote to memory of 2448 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 2232 wrote to memory of 2448 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 2232 wrote to memory of 2448 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 2232 wrote to memory of 2448 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe PID 2232 wrote to memory of 2448 2232 b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe"C:\Users\Admin\AppData\Local\Temp\b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b9b4d87c84f6baf4e71845c26c43e70b7c1c6d06a94e4a87df17a7e8dcf5530a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uJJKThDIVHPLhE.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uJJKThDIVHPLhE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7955.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7955.tmpFilesize
1KB
MD54901936a4d46e305913dc919a54c7782
SHA1707f85ec5b9ba9a95f738c645eba2b20db2319aa
SHA25651b0d5b528f208ec0903e76dc45bf4caf55ac01ecd7b91d2d535f752dfa46725
SHA5127f69de2409098fb233152a1a8d59981d1e6120ba6ff2fd3b30535768c753c1767a188ad77ccf7fee9cf74301e1d7e43ef2e2a80053028ef5dc30601ef159b59a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UEGQIOQCGMSCAXARAMQP.tempFilesize
7KB
MD5ea73a2e0c744203e0a2cd9739d097fb3
SHA1ccf04bc933148f139fbf97beba205f053fe412c9
SHA25640ca00ab31ef60ed4bcf10658de4244cbc95a89d450914e28682285cc6c97633
SHA51210682f6235a3cdb7ed953ed0a07e4bc037468acbf85289daa8cdb4b3319d328ef87e534b9663ab96578e661d245fceea67415ce35ec9efae643fb7b3407e05cf
-
memory/2208-35-0x0000000002600000-0x0000000002640000-memory.dmpFilesize
256KB
-
memory/2208-23-0x000000006E600000-0x000000006EBAB000-memory.dmpFilesize
5.7MB
-
memory/2208-38-0x0000000002600000-0x0000000002640000-memory.dmpFilesize
256KB
-
memory/2208-42-0x000000006E600000-0x000000006EBAB000-memory.dmpFilesize
5.7MB
-
memory/2232-3-0x00000000002D0000-0x00000000002E2000-memory.dmpFilesize
72KB
-
memory/2232-5-0x00000000051A0000-0x0000000005224000-memory.dmpFilesize
528KB
-
memory/2232-4-0x0000000000490000-0x000000000049C000-memory.dmpFilesize
48KB
-
memory/2232-37-0x00000000749E0000-0x00000000750CE000-memory.dmpFilesize
6.9MB
-
memory/2232-0-0x00000000001F0000-0x000000000029A000-memory.dmpFilesize
680KB
-
memory/2232-2-0x0000000002200000-0x0000000002240000-memory.dmpFilesize
256KB
-
memory/2232-1-0x00000000749E0000-0x00000000750CE000-memory.dmpFilesize
6.9MB
-
memory/2448-24-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2448-21-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2448-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2448-46-0x0000000004A60000-0x0000000004AA0000-memory.dmpFilesize
256KB
-
memory/2448-29-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2448-36-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2448-22-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2448-33-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2448-45-0x00000000749E0000-0x00000000750CE000-memory.dmpFilesize
6.9MB
-
memory/2448-41-0x0000000004A60000-0x0000000004AA0000-memory.dmpFilesize
256KB
-
memory/2448-40-0x00000000749E0000-0x00000000750CE000-memory.dmpFilesize
6.9MB
-
memory/2448-18-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2640-39-0x0000000002630000-0x0000000002670000-memory.dmpFilesize
256KB
-
memory/2640-25-0x0000000002630000-0x0000000002670000-memory.dmpFilesize
256KB
-
memory/2640-43-0x000000006E600000-0x000000006EBAB000-memory.dmpFilesize
5.7MB
-
memory/2640-20-0x000000006E600000-0x000000006EBAB000-memory.dmpFilesize
5.7MB
-
memory/2640-32-0x0000000002630000-0x0000000002670000-memory.dmpFilesize
256KB
-
memory/2640-30-0x000000006E600000-0x000000006EBAB000-memory.dmpFilesize
5.7MB