Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
30-03-2024 01:50
Static task
static1
Behavioral task
behavioral1
Sample
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe
Resource
win10v2004-20240226-en
General
-
Target
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe
-
Size
611KB
-
MD5
bb890594548df51e5957ca2445cd7fb8
-
SHA1
7aabf17acfff6e33ef68bbccea7b266a48205fff
-
SHA256
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e
-
SHA512
feaa88044792da5886b7fb4cf7eb4d67ca7be07b2376ae0e5d980be69c873f52db45eef9ab1e4b97f6dc9c1d99350fbbc579462bad7cb5bed49cbdb9752cd022
-
SSDEEP
12288:4SMpPbU8sOUVVhUF+i1c/OGNX+jkniNzXNDu8Z2RjbY8rk45az:4/pPbrUVo+sGNXPiN8W25YqtE
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 3948 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\"" ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
svchost.exedescription pid process target process PID 3948 set thread context of 1480 3948 svchost.exe regsvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1368 timeout.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exeregsvcs.exepid process 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe 1480 regsvcs.exe 1480 regsvcs.exe 1480 regsvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exesvchost.exeregsvcs.exedescription pid process Token: SeDebugPrivilege 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe Token: SeDebugPrivilege 3948 svchost.exe Token: SeDebugPrivilege 1480 regsvcs.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.execmd.execmd.exesvchost.exedescription pid process target process PID 2520 wrote to memory of 1968 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe cmd.exe PID 2520 wrote to memory of 1968 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe cmd.exe PID 2520 wrote to memory of 1108 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe cmd.exe PID 2520 wrote to memory of 1108 2520 ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe cmd.exe PID 1108 wrote to memory of 1368 1108 cmd.exe timeout.exe PID 1108 wrote to memory of 1368 1108 cmd.exe timeout.exe PID 1968 wrote to memory of 1588 1968 cmd.exe schtasks.exe PID 1968 wrote to memory of 1588 1968 cmd.exe schtasks.exe PID 1108 wrote to memory of 3948 1108 cmd.exe svchost.exe PID 1108 wrote to memory of 3948 1108 cmd.exe svchost.exe PID 3948 wrote to memory of 1480 3948 svchost.exe regsvcs.exe PID 3948 wrote to memory of 1480 3948 svchost.exe regsvcs.exe PID 3948 wrote to memory of 1480 3948 svchost.exe regsvcs.exe PID 3948 wrote to memory of 1480 3948 svchost.exe regsvcs.exe PID 3948 wrote to memory of 1480 3948 svchost.exe regsvcs.exe PID 3948 wrote to memory of 1480 3948 svchost.exe regsvcs.exe PID 3948 wrote to memory of 1480 3948 svchost.exe regsvcs.exe PID 3948 wrote to memory of 1480 3948 svchost.exe regsvcs.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe"C:\Users\Admin\AppData\Local\Temp\ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
PID:1588 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1F4B.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:1368 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3760 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵PID:4768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151B
MD5f348b3f1aaaaddfa2fbceec2186e5503
SHA16ce96332f0edfc39ebda01ff6701f5bb71284874
SHA2565ea4a753388361d4d29026c15a15598cd300aff4e4be66f1503a9546584a86e9
SHA512dfb77e1ec7030a434d22803edb31a1d16f8c4f710eed90f41b01c232e00a31f32f3ac7aa4394261a7c86da182907e41e70719c2775fcfeba44f9186b42cf217b
-
Filesize
611KB
MD5bb890594548df51e5957ca2445cd7fb8
SHA17aabf17acfff6e33ef68bbccea7b266a48205fff
SHA256ce021aaca1ac091165c6bd6d9b27d41c0994d308f39bce54a5d7e59ba76a421e
SHA512feaa88044792da5886b7fb4cf7eb4d67ca7be07b2376ae0e5d980be69c873f52db45eef9ab1e4b97f6dc9c1d99350fbbc579462bad7cb5bed49cbdb9752cd022