Analysis
-
max time kernel
13s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 02:14
Static task
static1
Behavioral task
behavioral1
Sample
bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7.exe
Resource
win10v2004-20240226-en
General
-
Target
bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7.exe
-
Size
772KB
-
MD5
7038d4d98c3b6f090f3256741222a8cb
-
SHA1
fc5728d10ce29f7c5255b5cc6f9c8f9010f3783f
-
SHA256
bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7
-
SHA512
cf1a435264ddc43bd938ef13d834282732fde5fe2d1ad7de97bd5d2202db00e99967c331d663098367f158a83b5eb76b9e8d90fba7b6b5b033d93e0259c91d32
-
SSDEEP
12288:TF2iNNt6DUTPle1gkFi3+K7WCKHlVPGfJlD9YHnx5X7s2neqealv312Z3Q:TF1wee1gR3baCIP0JwnPs2eCJ312ZQ
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.nizagorjemalo.hr - Port:
587 - Username:
[email protected] - Password:
Extreme192 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7.exedescription pid process target process PID 2612 wrote to memory of 2532 2612 bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7.exe powershell.exe PID 2612 wrote to memory of 2532 2612 bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7.exe powershell.exe PID 2612 wrote to memory of 2532 2612 bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7.exe powershell.exe PID 2612 wrote to memory of 2532 2612 bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7.exe powershell.exe PID 2612 wrote to memory of 2380 2612 bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7.exe schtasks.exe PID 2612 wrote to memory of 2380 2612 bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7.exe schtasks.exe PID 2612 wrote to memory of 2380 2612 bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7.exe schtasks.exe PID 2612 wrote to memory of 2380 2612 bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7.exe"C:\Users\Admin\AppData\Local\Temp\bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gjhiuwve.exe"2⤵PID:2532
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gjhiuwve" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBDD3.tmp"2⤵
- Creates scheduled task(s)
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7.exe"C:\Users\Admin\AppData\Local\Temp\bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7.exe"2⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7.exe"C:\Users\Admin\AppData\Local\Temp\bef2bb78ec1aeb4d981cd5819d54393d413a857fd8c670336ad37678157448e7.exe"2⤵PID:2400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpBDD3.tmpFilesize
1KB
MD50cef982f384995c8219aeb566fe8cb07
SHA18dea07db3230002f9f9ae16194271cdb074d0962
SHA256043fabcb44f9cf80b1832719ebbebff067eddb42faa0950263573852bda49b3b
SHA5124bbda939852e312fd8208e62eede0a5d60e20adff392f015ed5474af2c7c88846948e9d9542f51f92e36779f726ce7fa6926a536456ce024ff8253583639430e
-
memory/2400-23-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2400-12-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2400-26-0x00000000003C0000-0x0000000000400000-memory.dmpFilesize
256KB
-
memory/2400-32-0x0000000074B20000-0x000000007520E000-memory.dmpFilesize
6.9MB
-
memory/2400-16-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2400-21-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2400-11-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2400-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2400-25-0x0000000074B20000-0x000000007520E000-memory.dmpFilesize
6.9MB
-
memory/2400-19-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2400-33-0x00000000003C0000-0x0000000000400000-memory.dmpFilesize
256KB
-
memory/2400-13-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2532-31-0x000000006EFB0000-0x000000006F55B000-memory.dmpFilesize
5.7MB
-
memory/2532-27-0x000000006EFB0000-0x000000006F55B000-memory.dmpFilesize
5.7MB
-
memory/2532-28-0x000000006EFB0000-0x000000006F55B000-memory.dmpFilesize
5.7MB
-
memory/2532-30-0x00000000002C0000-0x0000000000300000-memory.dmpFilesize
256KB
-
memory/2532-29-0x00000000002C0000-0x0000000000300000-memory.dmpFilesize
256KB
-
memory/2612-24-0x0000000074B20000-0x000000007520E000-memory.dmpFilesize
6.9MB
-
memory/2612-1-0x0000000074B20000-0x000000007520E000-memory.dmpFilesize
6.9MB
-
memory/2612-5-0x0000000000850000-0x00000000008D2000-memory.dmpFilesize
520KB
-
memory/2612-2-0x00000000009A0000-0x00000000009E0000-memory.dmpFilesize
256KB
-
memory/2612-0-0x0000000000A20000-0x0000000000AE8000-memory.dmpFilesize
800KB
-
memory/2612-4-0x0000000002060000-0x0000000002074000-memory.dmpFilesize
80KB
-
memory/2612-3-0x00000000009E0000-0x0000000000A00000-memory.dmpFilesize
128KB