Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-03-2024 01:50
Static task
static1
Behavioral task
behavioral1
Sample
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe
Resource
win10v2004-20240226-en
General
-
Target
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe
-
Size
611KB
-
MD5
bb890594548df51e5957ca2445cd7fb8
-
SHA1
7aabf17acfff6e33ef68bbccea7b266a48205fff
-
SHA256
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e
-
SHA512
feaa88044792da5886b7fb4cf7eb4d67ca7be07b2376ae0e5d980be69c873f52db45eef9ab1e4b97f6dc9c1d99350fbbc579462bad7cb5bed49cbdb9752cd022
-
SSDEEP
12288:4SMpPbU8sOUVVhUF+i1c/OGNX+jkniNzXNDu8Z2RjbY8rk45az:4/pPbrUVo+sGNXPiN8W25YqtE
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2324 svchost.exe -
Loads dropped DLL 6 IoCs
Processes:
cmd.exeWerFault.exepid process 1612 cmd.exe 1152 WerFault.exe 1152 WerFault.exe 1152 WerFault.exe 1152 WerFault.exe 1152 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\"" ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
svchost.exedescription pid process target process PID 2324 set thread context of 872 2324 svchost.exe installutil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1968 timeout.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exeinstallutil.exepid process 2180 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2180 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2180 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 872 installutil.exe 872 installutil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exesvchost.exeinstallutil.exedescription pid process Token: SeDebugPrivilege 2180 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe Token: SeDebugPrivilege 2324 svchost.exe Token: SeDebugPrivilege 872 installutil.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.execmd.execmd.exesvchost.exedescription pid process target process PID 2180 wrote to memory of 2368 2180 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe cmd.exe PID 2180 wrote to memory of 2368 2180 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe cmd.exe PID 2180 wrote to memory of 2368 2180 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe cmd.exe PID 2180 wrote to memory of 1612 2180 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe cmd.exe PID 2180 wrote to memory of 1612 2180 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe cmd.exe PID 2180 wrote to memory of 1612 2180 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe cmd.exe PID 2368 wrote to memory of 1416 2368 cmd.exe schtasks.exe PID 2368 wrote to memory of 1416 2368 cmd.exe schtasks.exe PID 2368 wrote to memory of 1416 2368 cmd.exe schtasks.exe PID 1612 wrote to memory of 1968 1612 cmd.exe timeout.exe PID 1612 wrote to memory of 1968 1612 cmd.exe timeout.exe PID 1612 wrote to memory of 1968 1612 cmd.exe timeout.exe PID 1612 wrote to memory of 2324 1612 cmd.exe svchost.exe PID 1612 wrote to memory of 2324 1612 cmd.exe svchost.exe PID 1612 wrote to memory of 2324 1612 cmd.exe svchost.exe PID 2324 wrote to memory of 872 2324 svchost.exe installutil.exe PID 2324 wrote to memory of 872 2324 svchost.exe installutil.exe PID 2324 wrote to memory of 872 2324 svchost.exe installutil.exe PID 2324 wrote to memory of 872 2324 svchost.exe installutil.exe PID 2324 wrote to memory of 872 2324 svchost.exe installutil.exe PID 2324 wrote to memory of 872 2324 svchost.exe installutil.exe PID 2324 wrote to memory of 872 2324 svchost.exe installutil.exe PID 2324 wrote to memory of 872 2324 svchost.exe installutil.exe PID 2324 wrote to memory of 872 2324 svchost.exe installutil.exe PID 2324 wrote to memory of 872 2324 svchost.exe installutil.exe PID 2324 wrote to memory of 872 2324 svchost.exe installutil.exe PID 2324 wrote to memory of 872 2324 svchost.exe installutil.exe PID 2324 wrote to memory of 1152 2324 svchost.exe WerFault.exe PID 2324 wrote to memory of 1152 2324 svchost.exe WerFault.exe PID 2324 wrote to memory of 1152 2324 svchost.exe WerFault.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe"C:\Users\Admin\AppData\Local\Temp\ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp5BA7.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2324 -s 7164⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5BA7.tmp.batFilesize
151B
MD566f436bd2bbbe42cb21ad4108dcd49ec
SHA1a5f657fc118e82dc64250240730b39e7cd8bb533
SHA2569586122cbc74e348ba7abd73b6fc90cec67f33b0fb63ecdedadd31c925928aba
SHA5129efa6c7797491172c7d9a3748fdc0ae22f07839047b76126e4c425053b0438ae8aefbed2b92f70367297da5bf2fce4cbfbf646984fc780e2a356f2b1e646c429
-
\Users\Admin\AppData\Roaming\svchost.exeFilesize
611KB
MD5bb890594548df51e5957ca2445cd7fb8
SHA17aabf17acfff6e33ef68bbccea7b266a48205fff
SHA256ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e
SHA512feaa88044792da5886b7fb4cf7eb4d67ca7be07b2376ae0e5d980be69c873f52db45eef9ab1e4b97f6dc9c1d99350fbbc579462bad7cb5bed49cbdb9752cd022
-
memory/872-30-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/872-39-0x0000000074ED0000-0x00000000755BE000-memory.dmpFilesize
6.9MB
-
memory/872-44-0x0000000074ED0000-0x00000000755BE000-memory.dmpFilesize
6.9MB
-
memory/872-41-0x0000000004B40000-0x0000000004B80000-memory.dmpFilesize
256KB
-
memory/872-34-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/872-32-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/872-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/872-27-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/872-21-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/872-23-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/872-25-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2180-0-0x00000000009D0000-0x00000000009DC000-memory.dmpFilesize
48KB
-
memory/2180-1-0x000007FEF64E0000-0x000007FEF6ECC000-memory.dmpFilesize
9.9MB
-
memory/2180-3-0x0000000002080000-0x0000000002116000-memory.dmpFilesize
600KB
-
memory/2180-13-0x000007FEF64E0000-0x000007FEF6ECC000-memory.dmpFilesize
9.9MB
-
memory/2180-2-0x000000001B560000-0x000000001B5E0000-memory.dmpFilesize
512KB
-
memory/2324-20-0x000000001B250000-0x000000001B2D0000-memory.dmpFilesize
512KB
-
memory/2324-19-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmpFilesize
9.9MB
-
memory/2324-18-0x0000000000DE0000-0x0000000000DEC000-memory.dmpFilesize
48KB
-
memory/2324-42-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmpFilesize
9.9MB
-
memory/2324-43-0x000000001B250000-0x000000001B2D0000-memory.dmpFilesize
512KB