Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
26-04-2024 01:35
Static task
static1
Behavioral task
behavioral1
Sample
b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe
Resource
win10v2004-20240226-en
General
-
Target
b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe
-
Size
949KB
-
MD5
a94578e1a694ba09dc9ed5dc7df60fcc
-
SHA1
8ea85a39e4e456e79db46abfe00f9be73c8e254e
-
SHA256
b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9
-
SHA512
ab3277ca5e074100cc9323234ee257816261154bcd6da3b00c56a83b0f0923575649ec9c3272e5ac8da6bd4ae08f6757d7cd15147a15963d144b99be92a30565
-
SSDEEP
24576:8+17qWKvIj9RR5BGNn5BZj6ZNaJ312Zw471:t5AvIj9VB+j6naJl2iK1
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.unitechautomations.com - Port:
587 - Username:
design@unitechautomations.com - Password:
Unitech@123 - Email To:
overseas1@vestalshipping.com.vn
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\GUIVTme = "C:\\Users\\Admin\\AppData\\Roaming\\GUIVTme\\GUIVTme.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exedescription pid process target process PID 1512 set thread context of 2476 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exepowershell.exepowershell.exeRegSvcs.exepid process 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe 1796 powershell.exe 2136 powershell.exe 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe 2476 RegSvcs.exe 2476 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe Token: SeDebugPrivilege 1796 powershell.exe Token: SeDebugPrivilege 2136 powershell.exe Token: SeDebugPrivilege 2476 RegSvcs.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exedescription pid process target process PID 1512 wrote to memory of 1796 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe powershell.exe PID 1512 wrote to memory of 1796 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe powershell.exe PID 1512 wrote to memory of 1796 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe powershell.exe PID 1512 wrote to memory of 1796 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe powershell.exe PID 1512 wrote to memory of 2136 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe powershell.exe PID 1512 wrote to memory of 2136 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe powershell.exe PID 1512 wrote to memory of 2136 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe powershell.exe PID 1512 wrote to memory of 2136 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe powershell.exe PID 1512 wrote to memory of 2644 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe schtasks.exe PID 1512 wrote to memory of 2644 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe schtasks.exe PID 1512 wrote to memory of 2644 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe schtasks.exe PID 1512 wrote to memory of 2644 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe schtasks.exe PID 1512 wrote to memory of 2112 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe PID 1512 wrote to memory of 2112 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe PID 1512 wrote to memory of 2112 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe PID 1512 wrote to memory of 2112 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe PID 1512 wrote to memory of 2112 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe PID 1512 wrote to memory of 2112 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe PID 1512 wrote to memory of 2112 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe PID 1512 wrote to memory of 2476 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe PID 1512 wrote to memory of 2476 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe PID 1512 wrote to memory of 2476 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe PID 1512 wrote to memory of 2476 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe PID 1512 wrote to memory of 2476 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe PID 1512 wrote to memory of 2476 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe PID 1512 wrote to memory of 2476 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe PID 1512 wrote to memory of 2476 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe PID 1512 wrote to memory of 2476 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe PID 1512 wrote to memory of 2476 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe PID 1512 wrote to memory of 2476 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe PID 1512 wrote to memory of 2476 1512 b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe"C:\Users\Admin\AppData\Local\Temp\b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b06ef71a820a829fc010a3bc33b6c630282b94d831e25f972b7173f0783b76c9.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XblPOAvPsrUQv.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XblPOAvPsrUQv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4837.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4837.tmpFilesize
1KB
MD559fa255922bfd589b072817e9c09b865
SHA10b1961364cab04a8a419da93f01999c249e464ca
SHA256772807723a3c45c02a16ed189b3872dab1856790f8d3b57a0ce198ea8f95373b
SHA51246d8748e116c0fe4586769f0d888b4e86b54abe2bc4a935b28114e631c075875b2052fe610004b0bf068953b959aff1d0732f13bd78087ab27a211114896c7d5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XHV5E6WX6TMOCM16EF8O.tempFilesize
7KB
MD577e787847af4a5d377b7f50b2d1d52af
SHA11cd0959d28428de57304fd1bbe67ebf64151862b
SHA256cf388d534e56cd247ec2d2246064057e7f9a17a5bfca862bbe6055be6659f562
SHA512ce91cc1e33d393854509263f86e5f9251d9c119bcde5a7b2a27149940a7d8c8e92d2bd7fd20b2db9dca7427b6b0b0176b40100909995640410b1fece3baae697
-
memory/1512-39-0x00000000749D0000-0x00000000750BE000-memory.dmpFilesize
6.9MB
-
memory/1512-3-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1512-4-0x0000000000430000-0x0000000000444000-memory.dmpFilesize
80KB
-
memory/1512-5-0x0000000000690000-0x0000000000712000-memory.dmpFilesize
520KB
-
memory/1512-2-0x0000000004DE0000-0x0000000004E20000-memory.dmpFilesize
256KB
-
memory/1512-0-0x00000000000C0000-0x00000000001B4000-memory.dmpFilesize
976KB
-
memory/1512-1-0x00000000749D0000-0x00000000750BE000-memory.dmpFilesize
6.9MB
-
memory/1796-43-0x000000006EBA0000-0x000000006F14B000-memory.dmpFilesize
5.7MB
-
memory/1796-20-0x0000000001C10000-0x0000000001C50000-memory.dmpFilesize
256KB
-
memory/1796-22-0x000000006EBA0000-0x000000006F14B000-memory.dmpFilesize
5.7MB
-
memory/1796-24-0x0000000001C10000-0x0000000001C50000-memory.dmpFilesize
256KB
-
memory/1796-18-0x000000006EBA0000-0x000000006F14B000-memory.dmpFilesize
5.7MB
-
memory/2136-21-0x0000000002E10000-0x0000000002E50000-memory.dmpFilesize
256KB
-
memory/2136-23-0x000000006EBA0000-0x000000006F14B000-memory.dmpFilesize
5.7MB
-
memory/2136-19-0x000000006EBA0000-0x000000006F14B000-memory.dmpFilesize
5.7MB
-
memory/2136-42-0x000000006EBA0000-0x000000006F14B000-memory.dmpFilesize
5.7MB
-
memory/2476-27-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2476-34-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2476-30-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2476-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2476-40-0x00000000749D0000-0x00000000750BE000-memory.dmpFilesize
6.9MB
-
memory/2476-38-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2476-36-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2476-41-0x00000000047E0000-0x0000000004820000-memory.dmpFilesize
256KB
-
memory/2476-29-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2476-25-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2476-45-0x00000000749D0000-0x00000000750BE000-memory.dmpFilesize
6.9MB
-
memory/2476-46-0x00000000047E0000-0x0000000004820000-memory.dmpFilesize
256KB