Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 01:45
Static task
static1
Behavioral task
behavioral1
Sample
8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe
Resource
win10v2004-20240412-en
General
-
Target
8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe
-
Size
835KB
-
MD5
e7d52516ca8bcf4e8bcaf71a36a88300
-
SHA1
d5a7eaad95ab6d4e492b128db0cf550c34170c90
-
SHA256
8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc
-
SHA512
0dc86396301012e035ed03086436411b5abdbe7c2dc84b03d5385739250bf1efa1bc6fab96471eb277b62d7a3b1ea663565809493a26750951c6316b131c0751
-
SSDEEP
12288:+iEx72xrdlMXGnWnpLCzRdoJ6K5/w6ovt51qZ0o1LFMdDP+FIk7N:sSrdrWn4z26UNol510LFMdDP8Ik
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
u(!IUDW7 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2464-33-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2464-37-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2464-31-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2464-39-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2464-42-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2464-33-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2464-37-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2464-31-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2464-39-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2464-42-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2464-33-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2464-37-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2464-31-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2464-39-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/memory/2464-42-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL -
Detects executables referencing Windows vault credential objects. Observed in infostealers 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2464-33-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2464-37-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2464-31-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2464-39-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2464-42-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2464-33-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2464-37-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2464-31-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2464-39-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2464-42-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2464-33-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2464-37-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2464-31-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2464-39-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2464-42-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2464-33-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2464-37-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2464-31-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2464-39-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2464-42-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exedescription pid process target process PID 2008 set thread context of 2464 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exepowershell.exepowershell.exeRegSvcs.exepid process 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe 2660 powershell.exe 3064 powershell.exe 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe 2464 RegSvcs.exe 2464 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe Token: SeDebugPrivilege 2660 powershell.exe Token: SeDebugPrivilege 3064 powershell.exe Token: SeDebugPrivilege 2464 RegSvcs.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exedescription pid process target process PID 2008 wrote to memory of 3064 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe powershell.exe PID 2008 wrote to memory of 3064 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe powershell.exe PID 2008 wrote to memory of 3064 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe powershell.exe PID 2008 wrote to memory of 3064 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe powershell.exe PID 2008 wrote to memory of 2660 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe powershell.exe PID 2008 wrote to memory of 2660 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe powershell.exe PID 2008 wrote to memory of 2660 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe powershell.exe PID 2008 wrote to memory of 2660 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe powershell.exe PID 2008 wrote to memory of 2252 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe schtasks.exe PID 2008 wrote to memory of 2252 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe schtasks.exe PID 2008 wrote to memory of 2252 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe schtasks.exe PID 2008 wrote to memory of 2252 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe schtasks.exe PID 2008 wrote to memory of 2624 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe PID 2008 wrote to memory of 2624 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe PID 2008 wrote to memory of 2624 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe PID 2008 wrote to memory of 2624 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe PID 2008 wrote to memory of 2624 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe PID 2008 wrote to memory of 2624 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe PID 2008 wrote to memory of 2624 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe PID 2008 wrote to memory of 2464 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe PID 2008 wrote to memory of 2464 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe PID 2008 wrote to memory of 2464 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe PID 2008 wrote to memory of 2464 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe PID 2008 wrote to memory of 2464 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe PID 2008 wrote to memory of 2464 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe PID 2008 wrote to memory of 2464 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe PID 2008 wrote to memory of 2464 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe PID 2008 wrote to memory of 2464 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe PID 2008 wrote to memory of 2464 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe PID 2008 wrote to memory of 2464 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe PID 2008 wrote to memory of 2464 2008 8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe"C:\Users\Admin\AppData\Local\Temp\8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3064 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\emaGqYHYeYNHas.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\emaGqYHYeYNHas" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3968.tmp"2⤵
- Creates scheduled task(s)
PID:2252 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2624
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3968.tmpFilesize
1KB
MD59bd649f877bce199edf82dd6a26e10e7
SHA1bc8cbf8e21ae9de0e9dbbc64c4d81bfe9bb0a96e
SHA2567b1930e1e9f3e8403bf4a5a01e6a715d19c7065ccf56b2c077eff6a7f3393548
SHA512cef8661516ce29dbc2f82626d9ab457884d01857d21860e700be507dd15546de6321f5fb393de5b5aa7cba696d0babe55c3054b190f6bced68be75b2d328397a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5d1085f80ddd042534d84414a7cefb8c5
SHA1cc5040477fa0d7607690d2b78f549729ec83cc53
SHA2562b9cf33e05c95913d9b92d740b52f99675a9cc302607536d2426d5374b3c7c97
SHA5123d8499c7fd5217bf3d8f1d4f13fccb264238ee6f844af3077a9c02971b843a78b8ff741be9f1fd965fc3c2f7e65467083b1e2b491bde180884615f7360bca82f
-
memory/2008-41-0x0000000074840000-0x0000000074F2E000-memory.dmpFilesize
6.9MB
-
memory/2008-1-0x0000000074840000-0x0000000074F2E000-memory.dmpFilesize
6.9MB
-
memory/2008-2-0x0000000004A10000-0x0000000004A50000-memory.dmpFilesize
256KB
-
memory/2008-3-0x00000000004C0000-0x00000000004D8000-memory.dmpFilesize
96KB
-
memory/2008-4-0x00000000005D0000-0x00000000005DE000-memory.dmpFilesize
56KB
-
memory/2008-5-0x0000000000630000-0x0000000000644000-memory.dmpFilesize
80KB
-
memory/2008-6-0x0000000004920000-0x00000000049AC000-memory.dmpFilesize
560KB
-
memory/2008-7-0x0000000001EB0000-0x0000000001F34000-memory.dmpFilesize
528KB
-
memory/2008-0-0x0000000000840000-0x0000000000918000-memory.dmpFilesize
864KB
-
memory/2464-39-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2464-44-0x0000000004730000-0x0000000004770000-memory.dmpFilesize
256KB
-
memory/2464-48-0x0000000004730000-0x0000000004770000-memory.dmpFilesize
256KB
-
memory/2464-24-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2464-47-0x0000000073540000-0x0000000073C2E000-memory.dmpFilesize
6.9MB
-
memory/2464-43-0x0000000073540000-0x0000000073C2E000-memory.dmpFilesize
6.9MB
-
memory/2464-42-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2464-33-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2464-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2464-37-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2464-31-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2464-27-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2660-21-0x000000006F250000-0x000000006F7FB000-memory.dmpFilesize
5.7MB
-
memory/2660-29-0x0000000002E60000-0x0000000002EA0000-memory.dmpFilesize
256KB
-
memory/2660-22-0x0000000002E60000-0x0000000002EA0000-memory.dmpFilesize
256KB
-
memory/2660-45-0x000000006F250000-0x000000006F7FB000-memory.dmpFilesize
5.7MB
-
memory/2660-23-0x000000006F250000-0x000000006F7FB000-memory.dmpFilesize
5.7MB
-
memory/3064-20-0x000000006F250000-0x000000006F7FB000-memory.dmpFilesize
5.7MB
-
memory/3064-28-0x0000000002AA0000-0x0000000002AE0000-memory.dmpFilesize
256KB
-
memory/3064-46-0x000000006F250000-0x000000006F7FB000-memory.dmpFilesize
5.7MB
-
memory/3064-26-0x000000006F250000-0x000000006F7FB000-memory.dmpFilesize
5.7MB