Analysis
-
max time kernel
146s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
30-03-2024 01:04
Static task
static1
Behavioral task
behavioral1
Sample
3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe
Resource
win10v2004-20240226-en
General
-
Target
3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe
-
Size
662KB
-
MD5
349f17dbbb946bf88f86441a35ab8561
-
SHA1
c40216c6f241044260bc8a3e0501645a33a7aad8
-
SHA256
3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20
-
SHA512
ee7cbd7240e7440f22e32b920479e955a2fcedd39c8548eb25b71a5540c216472c9d025f92a8fcb6b557df94c0ea6af910f0515db1d67c364110a2aa1a855eac
-
SSDEEP
12288:vH2iNlw0i3nXIUjDYxIgCW3GQVKSUffm4LQ+B7sDisNdqcf:f1X4ndvyiW3GMKvr8Y78il
Malware Config
Extracted
Protocol: smtp- Host:
mail.cade.ro - Port:
587 - Username:
[email protected] - Password:
_5h))*rQ]Yhs
Extracted
agenttesla
Protocol: smtp- Host:
mail.cade.ro - Port:
587 - Username:
[email protected] - Password:
_5h))*rQ]Yhs - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 28 api.ipify.org 29 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exedescription pid process target process PID 1464 set thread context of 2992 1464 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exe3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exepid process 3328 powershell.exe 2992 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe 2992 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe 3328 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exe3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exedescription pid process Token: SeDebugPrivilege 3328 powershell.exe Token: SeDebugPrivilege 2992 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exedescription pid process target process PID 1464 wrote to memory of 3328 1464 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe powershell.exe PID 1464 wrote to memory of 3328 1464 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe powershell.exe PID 1464 wrote to memory of 3328 1464 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe powershell.exe PID 1464 wrote to memory of 2540 1464 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe schtasks.exe PID 1464 wrote to memory of 2540 1464 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe schtasks.exe PID 1464 wrote to memory of 2540 1464 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe schtasks.exe PID 1464 wrote to memory of 2992 1464 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe PID 1464 wrote to memory of 2992 1464 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe PID 1464 wrote to memory of 2992 1464 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe PID 1464 wrote to memory of 2992 1464 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe PID 1464 wrote to memory of 2992 1464 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe PID 1464 wrote to memory of 2992 1464 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe PID 1464 wrote to memory of 2992 1464 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe PID 1464 wrote to memory of 2992 1464 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe 3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe"C:\Users\Admin\AppData\Local\Temp\3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vbdzEVDHcjV.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vbdzEVDHcjV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAF1C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe"C:\Users\Admin\AppData\Local\Temp\3009aee6f49e882e9f60bd0ed1063ce47225b88c0fc1a51a1b695e086b915d20.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_erclush2.toq.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpAF1C.tmpFilesize
1KB
MD5d04a58699e1418a7ce47bd3c1e0124b2
SHA17252a213c25f39d30cdcf033f070b1157e9e5315
SHA2563ae9223e3abd0b9cd55751d3fe0a18d147c6506b579e3e28c3036da3a3a3de58
SHA512c1c357e0cd205a4b3ce69b625ab490d1c868f0db4696000b1eb27f03a64f4a3826e60b7c2f78092ddf56ee30fd9eb9c1f0b5ab7fbbd7fb0fd26f5abfa87bc903
-
memory/1464-0-0x0000000000780000-0x000000000082A000-memory.dmpFilesize
680KB
-
memory/1464-2-0x0000000005870000-0x0000000005E14000-memory.dmpFilesize
5.6MB
-
memory/1464-4-0x0000000005400000-0x0000000005410000-memory.dmpFilesize
64KB
-
memory/1464-5-0x00000000053C0000-0x00000000053CA000-memory.dmpFilesize
40KB
-
memory/1464-6-0x00000000054B0000-0x000000000554C000-memory.dmpFilesize
624KB
-
memory/1464-7-0x0000000005490000-0x00000000054A2000-memory.dmpFilesize
72KB
-
memory/1464-8-0x0000000005550000-0x000000000555C000-memory.dmpFilesize
48KB
-
memory/1464-9-0x00000000068B0000-0x0000000006934000-memory.dmpFilesize
528KB
-
memory/1464-24-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/1464-3-0x0000000005200000-0x0000000005292000-memory.dmpFilesize
584KB
-
memory/1464-1-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/2992-68-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/2992-57-0x0000000006E00000-0x0000000006E50000-memory.dmpFilesize
320KB
-
memory/2992-25-0x0000000005620000-0x0000000005630000-memory.dmpFilesize
64KB
-
memory/2992-20-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2992-23-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/2992-26-0x0000000005870000-0x00000000058D6000-memory.dmpFilesize
408KB
-
memory/2992-69-0x0000000005620000-0x0000000005630000-memory.dmpFilesize
64KB
-
memory/3328-27-0x0000000005C90000-0x0000000005CF6000-memory.dmpFilesize
408KB
-
memory/3328-55-0x0000000007C90000-0x000000000830A000-memory.dmpFilesize
6.5MB
-
memory/3328-19-0x0000000005560000-0x0000000005B88000-memory.dmpFilesize
6.2MB
-
memory/3328-17-0x0000000002A70000-0x0000000002A80000-memory.dmpFilesize
64KB
-
memory/3328-37-0x0000000005E70000-0x00000000061C4000-memory.dmpFilesize
3.3MB
-
memory/3328-38-0x0000000006330000-0x000000000634E000-memory.dmpFilesize
120KB
-
memory/3328-39-0x0000000006390000-0x00000000063DC000-memory.dmpFilesize
304KB
-
memory/3328-40-0x0000000002A70000-0x0000000002A80000-memory.dmpFilesize
64KB
-
memory/3328-41-0x000000007F240000-0x000000007F250000-memory.dmpFilesize
64KB
-
memory/3328-42-0x0000000007500000-0x0000000007532000-memory.dmpFilesize
200KB
-
memory/3328-43-0x00000000703D0000-0x000000007041C000-memory.dmpFilesize
304KB
-
memory/3328-53-0x00000000068F0000-0x000000000690E000-memory.dmpFilesize
120KB
-
memory/3328-54-0x0000000007540000-0x00000000075E3000-memory.dmpFilesize
652KB
-
memory/3328-22-0x0000000005380000-0x00000000053A2000-memory.dmpFilesize
136KB
-
memory/3328-56-0x0000000007650000-0x000000000766A000-memory.dmpFilesize
104KB
-
memory/3328-16-0x0000000002A70000-0x0000000002A80000-memory.dmpFilesize
64KB
-
memory/3328-58-0x00000000076C0000-0x00000000076CA000-memory.dmpFilesize
40KB
-
memory/3328-59-0x00000000078D0000-0x0000000007966000-memory.dmpFilesize
600KB
-
memory/3328-60-0x0000000007850000-0x0000000007861000-memory.dmpFilesize
68KB
-
memory/3328-61-0x0000000007880000-0x000000000788E000-memory.dmpFilesize
56KB
-
memory/3328-62-0x0000000007890000-0x00000000078A4000-memory.dmpFilesize
80KB
-
memory/3328-63-0x0000000007990000-0x00000000079AA000-memory.dmpFilesize
104KB
-
memory/3328-64-0x0000000007970000-0x0000000007978000-memory.dmpFilesize
32KB
-
memory/3328-67-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/3328-15-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/3328-14-0x0000000002A80000-0x0000000002AB6000-memory.dmpFilesize
216KB