Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 02:04
Static task
static1
Behavioral task
behavioral1
Sample
PROFORMA.exe
Resource
win7-20240221-en
General
-
Target
PROFORMA.exe
-
Size
8.8MB
-
MD5
65c1fa8d5b16889c823090165d0a87ce
-
SHA1
8040909cb66b5254acd7a59ccda780a4e4d594b1
-
SHA256
34a6209e1b5514ac0d575d5cf0b6453135dfdab81169207a2162763f46d24987
-
SHA512
444f70357d2e249a034190692063808557b7f6aa6fcf0a2dbb362c8c3d2f3aa6135eb2ecde1811ad0fae734575e4f15089fa7b4de73035c0a23f00e26767a9f4
-
SSDEEP
196608:X5rR04kTS0Dr+FSHYmwT1uKeGtyQe180u82ST3yux7Hmw+GfYr/Vv9id2Ky9iZdY:X5rR04kTS0Dr+FSHYmwT1uKeGtyQe187
Malware Config
Extracted
Protocol: smtp- Host:
mail.gencoldfire.com - Port:
587 - Username:
mozin@gencoldfire.com - Password:
%j#!%z2b/?qM68K#
Extracted
agenttesla
Protocol: smtp- Host:
mail.gencoldfire.com - Port:
587 - Username:
mozin@gencoldfire.com - Password:
%j#!%z2b/?qM68K# - Email To:
molog@gencoldfire.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 16 IoCs
Processes:
resource yara_rule behavioral2/memory/2428-4-0x0000000007610000-0x0000000007840000-memory.dmp family_zgrat_v1 behavioral2/memory/2428-7-0x0000000007610000-0x0000000007839000-memory.dmp family_zgrat_v1 behavioral2/memory/2428-9-0x0000000007610000-0x0000000007839000-memory.dmp family_zgrat_v1 behavioral2/memory/2428-11-0x0000000007610000-0x0000000007839000-memory.dmp family_zgrat_v1 behavioral2/memory/2428-15-0x0000000007610000-0x0000000007839000-memory.dmp family_zgrat_v1 behavioral2/memory/2428-17-0x0000000007610000-0x0000000007839000-memory.dmp family_zgrat_v1 behavioral2/memory/2428-19-0x0000000007610000-0x0000000007839000-memory.dmp family_zgrat_v1 behavioral2/memory/2428-21-0x0000000007610000-0x0000000007839000-memory.dmp family_zgrat_v1 behavioral2/memory/2428-23-0x0000000007610000-0x0000000007839000-memory.dmp family_zgrat_v1 behavioral2/memory/2428-27-0x0000000007610000-0x0000000007839000-memory.dmp family_zgrat_v1 behavioral2/memory/2428-31-0x0000000007610000-0x0000000007839000-memory.dmp family_zgrat_v1 behavioral2/memory/2428-33-0x0000000007610000-0x0000000007839000-memory.dmp family_zgrat_v1 behavioral2/memory/2428-29-0x0000000007610000-0x0000000007839000-memory.dmp family_zgrat_v1 behavioral2/memory/2428-25-0x0000000007610000-0x0000000007839000-memory.dmp family_zgrat_v1 behavioral2/memory/2428-13-0x0000000007610000-0x0000000007839000-memory.dmp family_zgrat_v1 behavioral2/memory/2428-6-0x0000000007610000-0x0000000007839000-memory.dmp family_zgrat_v1 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 37 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PROFORMA.exedescription pid process target process PID 2428 set thread context of 4836 2428 PROFORMA.exe PROFORMA.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
PROFORMA.exepid process 4836 PROFORMA.exe 4836 PROFORMA.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PROFORMA.exePROFORMA.exedescription pid process Token: SeDebugPrivilege 2428 PROFORMA.exe Token: SeDebugPrivilege 2428 PROFORMA.exe Token: SeDebugPrivilege 4836 PROFORMA.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
PROFORMA.exedescription pid process target process PID 2428 wrote to memory of 4836 2428 PROFORMA.exe PROFORMA.exe PID 2428 wrote to memory of 4836 2428 PROFORMA.exe PROFORMA.exe PID 2428 wrote to memory of 4836 2428 PROFORMA.exe PROFORMA.exe PID 2428 wrote to memory of 4836 2428 PROFORMA.exe PROFORMA.exe PID 2428 wrote to memory of 4836 2428 PROFORMA.exe PROFORMA.exe PID 2428 wrote to memory of 4836 2428 PROFORMA.exe PROFORMA.exe PID 2428 wrote to memory of 4836 2428 PROFORMA.exe PROFORMA.exe PID 2428 wrote to memory of 4836 2428 PROFORMA.exe PROFORMA.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PROFORMA.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PROFORMA.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1324 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2428-0-0x0000000074D00000-0x00000000754B0000-memory.dmpFilesize
7.7MB
-
memory/2428-1-0x0000000000620000-0x0000000000EF4000-memory.dmpFilesize
8.8MB
-
memory/2428-2-0x0000000005880000-0x0000000005912000-memory.dmpFilesize
584KB
-
memory/2428-3-0x0000000005800000-0x0000000005810000-memory.dmpFilesize
64KB
-
memory/2428-4-0x0000000007610000-0x0000000007840000-memory.dmpFilesize
2.2MB
-
memory/2428-5-0x0000000007E30000-0x00000000083D4000-memory.dmpFilesize
5.6MB
-
memory/2428-7-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-9-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-11-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-15-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-17-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-19-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-21-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-23-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-27-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-31-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-33-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-35-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-39-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-37-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-43-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-45-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-49-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-51-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-53-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-57-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-59-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-61-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-65-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-67-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-69-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-63-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-55-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-47-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-41-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-29-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-25-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-13-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-6-0x0000000007610000-0x0000000007839000-memory.dmpFilesize
2.2MB
-
memory/2428-1647-0x0000000074D00000-0x00000000754B0000-memory.dmpFilesize
7.7MB
-
memory/2428-1848-0x0000000005800000-0x0000000005810000-memory.dmpFilesize
64KB
-
memory/2428-4888-0x0000000000FC0000-0x0000000000FC1000-memory.dmpFilesize
4KB
-
memory/2428-4889-0x0000000001610000-0x000000000167C000-memory.dmpFilesize
432KB
-
memory/2428-4890-0x0000000001680000-0x00000000016CC000-memory.dmpFilesize
304KB
-
memory/2428-4891-0x0000000001820000-0x0000000001874000-memory.dmpFilesize
336KB
-
memory/2428-4895-0x0000000074D00000-0x00000000754B0000-memory.dmpFilesize
7.7MB
-
memory/4836-4892-0x0000000000F20000-0x0000000000F62000-memory.dmpFilesize
264KB
-
memory/4836-4894-0x0000000074D00000-0x00000000754B0000-memory.dmpFilesize
7.7MB
-
memory/4836-4896-0x0000000005650000-0x0000000005660000-memory.dmpFilesize
64KB
-
memory/4836-4897-0x00000000055A0000-0x0000000005606000-memory.dmpFilesize
408KB
-
memory/4836-4898-0x0000000006AE0000-0x0000000006B30000-memory.dmpFilesize
320KB
-
memory/4836-4899-0x0000000006BD0000-0x0000000006C6C000-memory.dmpFilesize
624KB
-
memory/4836-4900-0x0000000006DD0000-0x0000000006DDA000-memory.dmpFilesize
40KB
-
memory/4836-4901-0x0000000074D00000-0x00000000754B0000-memory.dmpFilesize
7.7MB
-
memory/4836-4902-0x0000000005650000-0x0000000005660000-memory.dmpFilesize
64KB