Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2024 03:07
Static task
static1
Behavioral task
behavioral1
Sample
PO 20240105.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
PO 20240105.exe
Resource
win10v2004-20240226-en
General
-
Target
PO 20240105.exe
-
Size
740KB
-
MD5
81d099f1008d98346919c22f105e26e5
-
SHA1
de77e686d32adca574703621974811dc6c7d3b31
-
SHA256
1ddead5d6964c8e382d3b2ea694774ff58486bcfb7996015561cc9a03c61b536
-
SHA512
b174aa74461edcc8afee22134084d6de4001fdf5d7012fbcd904f119d3959d776b43fd91a25147c20d2dcfa0d18eeb0b554155d2c7380d55030e6dd2e28bf794
-
SSDEEP
12288:Wd1JsJ6SH1Sh2iNwCZDcTsTmmk82Zzl2VLlh5AMOYFC6Vljc4J+G30NuqDpfLpPd:Wd4w1GQQABk1Zzl4ph5vtCi0hBDpfLG
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.starmech.net - Port:
587 - Username:
[email protected] - Password:
nics123 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PO 20240105.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation PO 20240105.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO 20240105.exedescription pid process target process PID 4048 set thread context of 1188 4048 PO 20240105.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
PO 20240105.exepowershell.exepowershell.exeRegSvcs.exepid process 4048 PO 20240105.exe 4048 PO 20240105.exe 3312 powershell.exe 3972 powershell.exe 4048 PO 20240105.exe 1188 RegSvcs.exe 1188 RegSvcs.exe 3972 powershell.exe 3312 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PO 20240105.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 4048 PO 20240105.exe Token: SeDebugPrivilege 3972 powershell.exe Token: SeDebugPrivilege 3312 powershell.exe Token: SeDebugPrivilege 1188 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
PO 20240105.exedescription pid process target process PID 4048 wrote to memory of 3972 4048 PO 20240105.exe powershell.exe PID 4048 wrote to memory of 3972 4048 PO 20240105.exe powershell.exe PID 4048 wrote to memory of 3972 4048 PO 20240105.exe powershell.exe PID 4048 wrote to memory of 3312 4048 PO 20240105.exe powershell.exe PID 4048 wrote to memory of 3312 4048 PO 20240105.exe powershell.exe PID 4048 wrote to memory of 3312 4048 PO 20240105.exe powershell.exe PID 4048 wrote to memory of 1040 4048 PO 20240105.exe schtasks.exe PID 4048 wrote to memory of 1040 4048 PO 20240105.exe schtasks.exe PID 4048 wrote to memory of 1040 4048 PO 20240105.exe schtasks.exe PID 4048 wrote to memory of 1188 4048 PO 20240105.exe RegSvcs.exe PID 4048 wrote to memory of 1188 4048 PO 20240105.exe RegSvcs.exe PID 4048 wrote to memory of 1188 4048 PO 20240105.exe RegSvcs.exe PID 4048 wrote to memory of 1188 4048 PO 20240105.exe RegSvcs.exe PID 4048 wrote to memory of 1188 4048 PO 20240105.exe RegSvcs.exe PID 4048 wrote to memory of 1188 4048 PO 20240105.exe RegSvcs.exe PID 4048 wrote to memory of 1188 4048 PO 20240105.exe RegSvcs.exe PID 4048 wrote to memory of 1188 4048 PO 20240105.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 20240105.exe"C:\Users\Admin\AppData\Local\Temp\PO 20240105.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO 20240105.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TZgkPJEad.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TZgkPJEad" /XML "C:\Users\Admin\AppData\Local\Temp\tmp925D.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD582ecb4f125f71e52f902ae6827f49841
SHA1d1e7a13bd06bbac5d54c6a87c4195ca523b77978
SHA25678fd1bb7f1e26972cd9067c65706ab2eea4c803d7592c815fced3a3b5e1a38cd
SHA512e3860b3af2d4c657ea4c5023b1dcdf87db5d3d17c8abdd37a6e385a5ad879672a90b2d94b94b21eaaaa5c44045db4c6965f8f63f5aa61f90a54846ee96fc7e36
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o1jl434y.ete.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp925D.tmpFilesize
1KB
MD51c30b1b54314edf591670e8916981cb2
SHA1ab548e2564fe0578b5683b6f52713a032c2cbd47
SHA2566c693738f4a7ff1cd2da2badb026eb970cf137ede16ca3387804a4708dbe19d4
SHA512de595d645a03e89cfb78cc9dba2f167c17ed51aeb982ee489d60dfa751ee44f39101d0c85d46a37bde48f08230239eb840aa20aa9df0065dad514040d4c4ebce
-
memory/1188-78-0x0000000006400000-0x0000000006450000-memory.dmpFilesize
320KB
-
memory/1188-95-0x00000000753B0000-0x0000000075B60000-memory.dmpFilesize
7.7MB
-
memory/1188-45-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1188-48-0x00000000753B0000-0x0000000075B60000-memory.dmpFilesize
7.7MB
-
memory/1188-50-0x0000000005570000-0x0000000005580000-memory.dmpFilesize
64KB
-
memory/3312-67-0x0000000075C10000-0x0000000075C5C000-memory.dmpFilesize
304KB
-
memory/3312-20-0x0000000003000000-0x0000000003010000-memory.dmpFilesize
64KB
-
memory/3312-82-0x0000000007EE0000-0x0000000007F76000-memory.dmpFilesize
600KB
-
memory/3312-83-0x0000000007E60000-0x0000000007E71000-memory.dmpFilesize
68KB
-
memory/3312-55-0x0000000007B30000-0x0000000007B62000-memory.dmpFilesize
200KB
-
memory/3312-53-0x0000000003000000-0x0000000003010000-memory.dmpFilesize
64KB
-
memory/3312-19-0x0000000003000000-0x0000000003010000-memory.dmpFilesize
64KB
-
memory/3312-80-0x0000000007C60000-0x0000000007C7A000-memory.dmpFilesize
104KB
-
memory/3312-23-0x00000000753B0000-0x0000000075B60000-memory.dmpFilesize
7.7MB
-
memory/3312-52-0x0000000006AF0000-0x0000000006B3C000-memory.dmpFilesize
304KB
-
memory/3312-84-0x0000000007E90000-0x0000000007E9E000-memory.dmpFilesize
56KB
-
memory/3312-85-0x0000000007EA0000-0x0000000007EB4000-memory.dmpFilesize
80KB
-
memory/3312-25-0x0000000006310000-0x0000000006376000-memory.dmpFilesize
408KB
-
memory/3312-86-0x0000000007FA0000-0x0000000007FBA000-memory.dmpFilesize
104KB
-
memory/3312-40-0x0000000006380000-0x00000000066D4000-memory.dmpFilesize
3.3MB
-
memory/3312-93-0x00000000753B0000-0x0000000075B60000-memory.dmpFilesize
7.7MB
-
memory/3972-18-0x00000000056C0000-0x0000000005CE8000-memory.dmpFilesize
6.2MB
-
memory/3972-15-0x00000000753B0000-0x0000000075B60000-memory.dmpFilesize
7.7MB
-
memory/3972-94-0x00000000753B0000-0x0000000075B60000-memory.dmpFilesize
7.7MB
-
memory/3972-24-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/3972-51-0x0000000006490000-0x00000000064AE000-memory.dmpFilesize
120KB
-
memory/3972-22-0x00000000054C0000-0x00000000054E2000-memory.dmpFilesize
136KB
-
memory/3972-17-0x0000000005080000-0x0000000005090000-memory.dmpFilesize
64KB
-
memory/3972-54-0x0000000005080000-0x0000000005090000-memory.dmpFilesize
64KB
-
memory/3972-56-0x0000000075C10000-0x0000000075C5C000-memory.dmpFilesize
304KB
-
memory/3972-87-0x0000000007AC0000-0x0000000007AC8000-memory.dmpFilesize
32KB
-
memory/3972-66-0x0000000006A50000-0x0000000006A6E000-memory.dmpFilesize
120KB
-
memory/3972-16-0x0000000005080000-0x0000000005090000-memory.dmpFilesize
64KB
-
memory/3972-68-0x00000000076C0000-0x0000000007763000-memory.dmpFilesize
652KB
-
memory/3972-81-0x0000000007810000-0x000000000781A000-memory.dmpFilesize
40KB
-
memory/3972-79-0x0000000007DF0000-0x000000000846A000-memory.dmpFilesize
6.5MB
-
memory/3972-14-0x0000000002B50000-0x0000000002B86000-memory.dmpFilesize
216KB
-
memory/4048-49-0x00000000753B0000-0x0000000075B60000-memory.dmpFilesize
7.7MB
-
memory/4048-9-0x0000000006630000-0x00000000066B2000-memory.dmpFilesize
520KB
-
memory/4048-8-0x00000000052C0000-0x00000000052CC000-memory.dmpFilesize
48KB
-
memory/4048-7-0x00000000052B0000-0x00000000052C2000-memory.dmpFilesize
72KB
-
memory/4048-6-0x0000000005110000-0x00000000051AC000-memory.dmpFilesize
624KB
-
memory/4048-5-0x0000000004FF0000-0x0000000004FFA000-memory.dmpFilesize
40KB
-
memory/4048-1-0x0000000000390000-0x000000000044C000-memory.dmpFilesize
752KB
-
memory/4048-4-0x0000000005060000-0x0000000005070000-memory.dmpFilesize
64KB
-
memory/4048-3-0x0000000004E40000-0x0000000004ED2000-memory.dmpFilesize
584KB
-
memory/4048-47-0x00000000753B0000-0x0000000075B60000-memory.dmpFilesize
7.7MB
-
memory/4048-2-0x0000000005350000-0x00000000058F4000-memory.dmpFilesize
5.6MB
-
memory/4048-0-0x00000000753B0000-0x0000000075B60000-memory.dmpFilesize
7.7MB