Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30-03-2024 01:30
Static task
static1
Behavioral task
behavioral1
Sample
76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe
Resource
win10v2004-20240226-en
General
-
Target
76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe
-
Size
668KB
-
MD5
97baad479477574de262496cd52eaf23
-
SHA1
d1df999063a5ece1f7acb295eb99f56fef6f385f
-
SHA256
76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682
-
SHA512
4572ca0addb5622e74cbac0c2c0381258c4f3f23d4e9a8eb8ac934a4a34a03035f7197da4406dd7916bee2190708b128b0e1c45dfe5ac3a75b59768fb82ace21
-
SSDEEP
12288:4wzLK1tUfoOkjDg5oagvMVnOS9ZKuyXxicuJd3G9b9aFge+u+4TSER:4iitmoOkjiQunOS9SaJ4raCe+u+U
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.satsllc.ae - Port:
587 - Username:
[email protected] - Password:
Ahsan@12345 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exepowershell.exepid process 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 2860 powershell.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exepowershell.exedescription pid process Token: SeDebugPrivilege 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe Token: SeDebugPrivilege 2860 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exedescription pid process target process PID 3040 wrote to memory of 2860 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe powershell.exe PID 3040 wrote to memory of 2860 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe powershell.exe PID 3040 wrote to memory of 2860 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe powershell.exe PID 3040 wrote to memory of 2860 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe powershell.exe PID 3040 wrote to memory of 2252 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe schtasks.exe PID 3040 wrote to memory of 2252 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe schtasks.exe PID 3040 wrote to memory of 2252 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe schtasks.exe PID 3040 wrote to memory of 2252 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe schtasks.exe PID 3040 wrote to memory of 2656 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe RegSvcs.exe PID 3040 wrote to memory of 2656 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe RegSvcs.exe PID 3040 wrote to memory of 2656 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe RegSvcs.exe PID 3040 wrote to memory of 2656 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe RegSvcs.exe PID 3040 wrote to memory of 2656 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe RegSvcs.exe PID 3040 wrote to memory of 2656 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe RegSvcs.exe PID 3040 wrote to memory of 2656 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe RegSvcs.exe PID 3040 wrote to memory of 2656 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe RegSvcs.exe PID 3040 wrote to memory of 2656 3040 76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe"C:\Users\Admin\AppData\Local\Temp\76898e1dff3ed8e3424a70e5613fb1a22cae12ed87efc596a9435808093c9682.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HXdFySPLBBf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HXdFySPLBBf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp41F0.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp41F0.tmpFilesize
1KB
MD5b2ec450cba1208f89dfe74cd5b1eaf83
SHA1a02deeaf059ffa7da2f2af5ce7d6d812f09a6f8e
SHA25678822f664d52938845f657944803e73b8726225aa1f8a44381ce781f543a6d88
SHA512053f92fee0dee87068371d186e55aaff16ad6dd5a299fdfee9365d5e7a9c16593ff6df9ffd607d69a7c8d3710ab5c7476879d655bd3a7bc41058eefdc22a71e4
-
memory/2656-21-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2656-18-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2656-14-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2860-22-0x00000000027D0000-0x0000000002810000-memory.dmpFilesize
256KB
-
memory/2860-20-0x00000000027D0000-0x0000000002810000-memory.dmpFilesize
256KB
-
memory/2860-23-0x000000006F1E0000-0x000000006F78B000-memory.dmpFilesize
5.7MB
-
memory/2860-17-0x000000006F1E0000-0x000000006F78B000-memory.dmpFilesize
5.7MB
-
memory/2860-13-0x000000006F1E0000-0x000000006F78B000-memory.dmpFilesize
5.7MB
-
memory/2860-16-0x00000000027D0000-0x0000000002810000-memory.dmpFilesize
256KB
-
memory/3040-2-0x0000000004F60000-0x0000000004FA0000-memory.dmpFilesize
256KB
-
memory/3040-5-0x00000000053D0000-0x0000000005452000-memory.dmpFilesize
520KB
-
memory/3040-0-0x0000000000A60000-0x0000000000B0C000-memory.dmpFilesize
688KB
-
memory/3040-1-0x0000000074BF0000-0x00000000752DE000-memory.dmpFilesize
6.9MB
-
memory/3040-3-0x00000000004C0000-0x00000000004DA000-memory.dmpFilesize
104KB
-
memory/3040-4-0x00000000004E0000-0x00000000004EC000-memory.dmpFilesize
48KB
-
memory/3040-24-0x0000000074BF0000-0x00000000752DE000-memory.dmpFilesize
6.9MB
-
memory/3040-25-0x0000000004F60000-0x0000000004FA0000-memory.dmpFilesize
256KB