Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
29-03-2024 03:07
Static task
static1
Behavioral task
behavioral1
Sample
PO 20240105.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
PO 20240105.exe
Resource
win10v2004-20240226-en
General
-
Target
PO 20240105.exe
-
Size
740KB
-
MD5
81d099f1008d98346919c22f105e26e5
-
SHA1
de77e686d32adca574703621974811dc6c7d3b31
-
SHA256
1ddead5d6964c8e382d3b2ea694774ff58486bcfb7996015561cc9a03c61b536
-
SHA512
b174aa74461edcc8afee22134084d6de4001fdf5d7012fbcd904f119d3959d776b43fd91a25147c20d2dcfa0d18eeb0b554155d2c7380d55030e6dd2e28bf794
-
SSDEEP
12288:Wd1JsJ6SH1Sh2iNwCZDcTsTmmk82Zzl2VLlh5AMOYFC6Vljc4J+G30NuqDpfLpPd:Wd4w1GQQABk1Zzl4ph5vtCi0hBDpfLG
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.starmech.net - Port:
587 - Username:
[email protected] - Password:
nics123 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO 20240105.exedescription pid process target process PID 2256 set thread context of 2788 2256 PO 20240105.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
PO 20240105.exepowershell.exepowershell.exeRegSvcs.exepid process 2256 PO 20240105.exe 2256 PO 20240105.exe 2524 powershell.exe 2680 powershell.exe 2256 PO 20240105.exe 2788 RegSvcs.exe 2788 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PO 20240105.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2256 PO 20240105.exe Token: SeDebugPrivilege 2524 powershell.exe Token: SeDebugPrivilege 2680 powershell.exe Token: SeDebugPrivilege 2788 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
PO 20240105.exedescription pid process target process PID 2256 wrote to memory of 2524 2256 PO 20240105.exe powershell.exe PID 2256 wrote to memory of 2524 2256 PO 20240105.exe powershell.exe PID 2256 wrote to memory of 2524 2256 PO 20240105.exe powershell.exe PID 2256 wrote to memory of 2524 2256 PO 20240105.exe powershell.exe PID 2256 wrote to memory of 2680 2256 PO 20240105.exe powershell.exe PID 2256 wrote to memory of 2680 2256 PO 20240105.exe powershell.exe PID 2256 wrote to memory of 2680 2256 PO 20240105.exe powershell.exe PID 2256 wrote to memory of 2680 2256 PO 20240105.exe powershell.exe PID 2256 wrote to memory of 2572 2256 PO 20240105.exe schtasks.exe PID 2256 wrote to memory of 2572 2256 PO 20240105.exe schtasks.exe PID 2256 wrote to memory of 2572 2256 PO 20240105.exe schtasks.exe PID 2256 wrote to memory of 2572 2256 PO 20240105.exe schtasks.exe PID 2256 wrote to memory of 2788 2256 PO 20240105.exe RegSvcs.exe PID 2256 wrote to memory of 2788 2256 PO 20240105.exe RegSvcs.exe PID 2256 wrote to memory of 2788 2256 PO 20240105.exe RegSvcs.exe PID 2256 wrote to memory of 2788 2256 PO 20240105.exe RegSvcs.exe PID 2256 wrote to memory of 2788 2256 PO 20240105.exe RegSvcs.exe PID 2256 wrote to memory of 2788 2256 PO 20240105.exe RegSvcs.exe PID 2256 wrote to memory of 2788 2256 PO 20240105.exe RegSvcs.exe PID 2256 wrote to memory of 2788 2256 PO 20240105.exe RegSvcs.exe PID 2256 wrote to memory of 2788 2256 PO 20240105.exe RegSvcs.exe PID 2256 wrote to memory of 2788 2256 PO 20240105.exe RegSvcs.exe PID 2256 wrote to memory of 2788 2256 PO 20240105.exe RegSvcs.exe PID 2256 wrote to memory of 2788 2256 PO 20240105.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 20240105.exe"C:\Users\Admin\AppData\Local\Temp\PO 20240105.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO 20240105.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TZgkPJEad.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TZgkPJEad" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6C98.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6C98.tmpFilesize
1KB
MD5464f1eec447cdcb339c637ef63f582b5
SHA172c646d2fa4138172f3da7fb86b8b35ae871e7c7
SHA2563b8416ae92a82e3b4250def75d999eb1606afc1b85c0682658dbd0c7af2fdcef
SHA5129566f4a959e1dd83ce88386a123161142f1c0a5aee5051be0d5c506a50c4a6a189572fbf0bf8b1d62713ef01e05d8b8f02edba90fdc043016352436c01a64056
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5dd5b9d969188bc22ce1548d721c55f79
SHA17f832d234335061c29a967af55a9d92a806ce2a4
SHA256919efe2136985a1a62ee22a6c94876c13981d0f8a816636c7c36242095874ca1
SHA512447266261eac2c50f744255cd2b503283e8c141957121f79ec334549265fb24f82888477c46c306791f8344925675e9c40cbf2eeae088725704c9cad38cde2d3
-
memory/2256-0-0x00000000001C0000-0x000000000027C000-memory.dmpFilesize
752KB
-
memory/2256-1-0x0000000074AE0000-0x00000000751CE000-memory.dmpFilesize
6.9MB
-
memory/2256-2-0x0000000004960000-0x00000000049A0000-memory.dmpFilesize
256KB
-
memory/2256-3-0x0000000000390000-0x00000000003A2000-memory.dmpFilesize
72KB
-
memory/2256-4-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2256-5-0x0000000005C40000-0x0000000005CC2000-memory.dmpFilesize
520KB
-
memory/2256-45-0x0000000074AE0000-0x00000000751CE000-memory.dmpFilesize
6.9MB
-
memory/2524-43-0x00000000023F0000-0x0000000002430000-memory.dmpFilesize
256KB
-
memory/2524-29-0x000000006EDB0000-0x000000006F35B000-memory.dmpFilesize
5.7MB
-
memory/2524-32-0x00000000023F0000-0x0000000002430000-memory.dmpFilesize
256KB
-
memory/2524-46-0x000000006EDB0000-0x000000006F35B000-memory.dmpFilesize
5.7MB
-
memory/2524-39-0x00000000023F0000-0x0000000002430000-memory.dmpFilesize
256KB
-
memory/2524-22-0x000000006EDB0000-0x000000006F35B000-memory.dmpFilesize
5.7MB
-
memory/2680-36-0x00000000026C0000-0x0000000002700000-memory.dmpFilesize
256KB
-
memory/2680-47-0x000000006EDB0000-0x000000006F35B000-memory.dmpFilesize
5.7MB
-
memory/2680-25-0x000000006EDB0000-0x000000006F35B000-memory.dmpFilesize
5.7MB
-
memory/2680-27-0x00000000026C0000-0x0000000002700000-memory.dmpFilesize
256KB
-
memory/2680-31-0x000000006EDB0000-0x000000006F35B000-memory.dmpFilesize
5.7MB
-
memory/2680-34-0x00000000026C0000-0x0000000002700000-memory.dmpFilesize
256KB
-
memory/2788-41-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2788-38-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2788-35-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2788-20-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2788-42-0x0000000074AE0000-0x00000000751CE000-memory.dmpFilesize
6.9MB
-
memory/2788-26-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2788-44-0x00000000045A0000-0x00000000045E0000-memory.dmpFilesize
256KB
-
memory/2788-18-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2788-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2788-23-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2788-48-0x0000000074AE0000-0x00000000751CE000-memory.dmpFilesize
6.9MB
-
memory/2788-49-0x00000000045A0000-0x00000000045E0000-memory.dmpFilesize
256KB