Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 03:45
Static task
static1
Behavioral task
behavioral1
Sample
5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe
Resource
win10v2004-20240412-en
General
-
Target
5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe
-
Size
841KB
-
MD5
75ed7ada6d18a65d8bc94be6f96211c1
-
SHA1
b5192d012d297f1e939632053a231ec9b63b2c67
-
SHA256
5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8
-
SHA512
b75393821360ee51258e608177eefe1209d255488078b58a4d6da503b23f48fb40aa5d5ced8fa2f445b492c698b71b7f82d31da58e3a233fea6f5cce22d7977f
-
SSDEEP
12288:CfBa4VcKFZCKnOyAucLOvJ5+PrdLX2jzw0qUh5ZE2U38shqhSOS:C5msnNELhzp2j0KS2U38gl
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
nne dimma080 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exedescription pid process target process PID 2388 set thread context of 2536 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exepowershell.exepowershell.exe5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exepid process 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe 2568 powershell.exe 2728 powershell.exe 2536 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe 2536 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exepowershell.exepowershell.exe5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exedescription pid process Token: SeDebugPrivilege 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe Token: SeDebugPrivilege 2568 powershell.exe Token: SeDebugPrivilege 2728 powershell.exe Token: SeDebugPrivilege 2536 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exedescription pid process target process PID 2388 wrote to memory of 2568 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe powershell.exe PID 2388 wrote to memory of 2568 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe powershell.exe PID 2388 wrote to memory of 2568 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe powershell.exe PID 2388 wrote to memory of 2568 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe powershell.exe PID 2388 wrote to memory of 2728 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe powershell.exe PID 2388 wrote to memory of 2728 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe powershell.exe PID 2388 wrote to memory of 2728 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe powershell.exe PID 2388 wrote to memory of 2728 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe powershell.exe PID 2388 wrote to memory of 2876 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe schtasks.exe PID 2388 wrote to memory of 2876 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe schtasks.exe PID 2388 wrote to memory of 2876 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe schtasks.exe PID 2388 wrote to memory of 2876 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe schtasks.exe PID 2388 wrote to memory of 2536 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe PID 2388 wrote to memory of 2536 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe PID 2388 wrote to memory of 2536 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe PID 2388 wrote to memory of 2536 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe PID 2388 wrote to memory of 2536 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe PID 2388 wrote to memory of 2536 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe PID 2388 wrote to memory of 2536 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe PID 2388 wrote to memory of 2536 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe PID 2388 wrote to memory of 2536 2388 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe 5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe"C:\Users\Admin\AppData\Local\Temp\5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\FnaENjVXOCyhBY.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FnaENjVXOCyhBY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3820.tmp"2⤵
- Creates scheduled task(s)
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe"C:\Users\Admin\AppData\Local\Temp\5bb5dab4e306d78f20a799afa2b943d5a5a1e4b91252050a76208d22cde932e8.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3820.tmpFilesize
1KB
MD5927e8bf909f7d6a573aa6b188173ec01
SHA137f497a2b7b29fc40f2be6d669ed272db9770676
SHA2567c884a4d6f798ffc875f9926dc741f5c35d70091249fa8b843bc7a113cf2e5ce
SHA5128a32e3dd9bdcc9aa5864e0a874901f92f0ab8ee1a34cc05a01b7ac5bcab02969d435888b11fc99712159fedf195d752c0d831bcd95caa2760e5d578a42928b24
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\26O97D4KXQF2P9OAU3IT.tempFilesize
7KB
MD5275f95333d2af271d6a721647655e479
SHA12fa2ef1eb45f4bcd8f36fcecccb8e438438406b9
SHA256466138a6464009d01e736aaad1b4190dc4129b6d1beae66fce94801d045f4adf
SHA5128f872f9e7479627f2ce7d0118f3afc196d23cc6f49954977ee3920b7b4616a9c6e0878f64803c915b90e529459f797bc95eea83d1e141d6a813e9d89d7ca72ea
-
memory/2388-1-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/2388-0-0x0000000000B30000-0x0000000000C08000-memory.dmpFilesize
864KB
-
memory/2388-2-0x0000000004A40000-0x0000000004A80000-memory.dmpFilesize
256KB
-
memory/2388-3-0x0000000000420000-0x0000000000438000-memory.dmpFilesize
96KB
-
memory/2388-4-0x0000000000440000-0x000000000044E000-memory.dmpFilesize
56KB
-
memory/2388-5-0x0000000000460000-0x0000000000474000-memory.dmpFilesize
80KB
-
memory/2388-6-0x0000000004D60000-0x0000000004DEE000-memory.dmpFilesize
568KB
-
memory/2388-7-0x00000000005A0000-0x0000000000624000-memory.dmpFilesize
528KB
-
memory/2388-31-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/2536-30-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2536-43-0x00000000009D0000-0x0000000000A10000-memory.dmpFilesize
256KB
-
memory/2536-24-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2536-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2536-28-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2536-22-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2536-20-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2536-33-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2536-48-0x00000000009D0000-0x0000000000A10000-memory.dmpFilesize
256KB
-
memory/2536-47-0x0000000073610000-0x0000000073CFE000-memory.dmpFilesize
6.9MB
-
memory/2536-42-0x0000000073610000-0x0000000073CFE000-memory.dmpFilesize
6.9MB
-
memory/2536-23-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2568-41-0x0000000002CA0000-0x0000000002CE0000-memory.dmpFilesize
256KB
-
memory/2568-36-0x0000000002CA0000-0x0000000002CE0000-memory.dmpFilesize
256KB
-
memory/2568-44-0x000000006F810000-0x000000006FDBB000-memory.dmpFilesize
5.7MB
-
memory/2568-46-0x000000006F810000-0x000000006FDBB000-memory.dmpFilesize
5.7MB
-
memory/2568-35-0x000000006F810000-0x000000006FDBB000-memory.dmpFilesize
5.7MB
-
memory/2728-38-0x000000006F810000-0x000000006FDBB000-memory.dmpFilesize
5.7MB
-
memory/2728-40-0x0000000001DF0000-0x0000000001E30000-memory.dmpFilesize
256KB
-
memory/2728-39-0x0000000001DF0000-0x0000000001E30000-memory.dmpFilesize
256KB
-
memory/2728-37-0x0000000001DF0000-0x0000000001E30000-memory.dmpFilesize
256KB
-
memory/2728-45-0x000000006F810000-0x000000006FDBB000-memory.dmpFilesize
5.7MB
-
memory/2728-34-0x000000006F810000-0x000000006FDBB000-memory.dmpFilesize
5.7MB