Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 02:22
Static task
static1
Behavioral task
behavioral1
Sample
cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe
Resource
win10v2004-20240412-en
General
-
Target
cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe
-
Size
766KB
-
MD5
1a90002a3504e10b40065d4e9a84fb74
-
SHA1
5f449ecaffc2e8097607bcb653c968b73472b37a
-
SHA256
cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541
-
SHA512
b2e81ed18947f24985771b7d3b89b5c7bae73c63d8552d2237bc6ad775d833d0e4b077c2e04b3822c98b7a299334b567ea0aa02abd9bbff4f214f6a132abc71a
-
SSDEEP
12288:CWYIPXjxannnHg2t6/zCSQ38syT2u0foDRfDiEvM4eTuxgOcCjzt6+Myv4sHck1L:CWYIPFannnHg2f383T2u80fzM6gOcSzo
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot7018885263:AAHT8gfvHTY09mtqDC-rbN8-23c7akL5PN8/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 54 api.ipify.org 55 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exedescription pid process target process PID 2932 set thread context of 1072 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exepowershell.exepowershell.exececb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exepid process 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe 220 powershell.exe 3008 powershell.exe 3008 powershell.exe 220 powershell.exe 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe 1072 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe 1072 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe 1072 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe 220 powershell.exe 3008 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exepowershell.exepowershell.exececb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exedescription pid process Token: SeDebugPrivilege 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe Token: SeDebugPrivilege 3008 powershell.exe Token: SeDebugPrivilege 220 powershell.exe Token: SeDebugPrivilege 1072 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exepid process 1072 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exedescription pid process target process PID 2932 wrote to memory of 220 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe powershell.exe PID 2932 wrote to memory of 220 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe powershell.exe PID 2932 wrote to memory of 220 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe powershell.exe PID 2932 wrote to memory of 3008 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe powershell.exe PID 2932 wrote to memory of 3008 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe powershell.exe PID 2932 wrote to memory of 3008 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe powershell.exe PID 2932 wrote to memory of 1424 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe schtasks.exe PID 2932 wrote to memory of 1424 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe schtasks.exe PID 2932 wrote to memory of 1424 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe schtasks.exe PID 2932 wrote to memory of 1072 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe PID 2932 wrote to memory of 1072 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe PID 2932 wrote to memory of 1072 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe PID 2932 wrote to memory of 1072 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe PID 2932 wrote to memory of 1072 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe PID 2932 wrote to memory of 1072 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe PID 2932 wrote to memory of 1072 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe PID 2932 wrote to memory of 1072 2932 cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe"C:\Users\Admin\AppData\Local\Temp\cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xLytDzpPseqL.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xLytDzpPseqL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC65D.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe"C:\Users\Admin\AppData\Local\Temp\cecb6db9d3e82cd3150ad7c144192e300bb86678ff4a8098d3e8723b50668541.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5ef0b37908a2b4daf421e446bf6d18d2b
SHA1bdb0982b4bcdb6a82cfa6962ffe5c454dc382ee1
SHA256daea1363d88f05de71e3c48199e53b871e34680b96310323e93b851b76243ce0
SHA51286ef68c4d6134c0ecbfacc226cdb2b00e8ff5378a090eb7ffa135c1cf3aef80065160740766dac7f5e5225f5d849481b23b69d1f64e537217f51145aa2a2011b
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ljox4nzc.dy1.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpC65D.tmpFilesize
1KB
MD52e6a0a2f1e22f1815f3fe3b85dfff3ed
SHA13dbf0829eb20bcf42678d13d8adc330164eab1fb
SHA256de3afc4fa65481eec202418bf73cc0b9ca907f4ab22b1727d5f2cd0bc1b2dea7
SHA5129533cb55d1e4c32467f30c8c9dc4f258f6c092fcbeab4af75976da3dd4306e7c5f9ad5c01b178f2336d4b18c6e6f8c01da0884e173c4d64db8e3fb947a7df486
-
memory/220-83-0x00000000079D0000-0x000000000804A000-memory.dmpFilesize
6.5MB
-
memory/220-85-0x0000000007400000-0x000000000740A000-memory.dmpFilesize
40KB
-
memory/220-54-0x0000000007020000-0x0000000007052000-memory.dmpFilesize
200KB
-
memory/220-67-0x00000000065E0000-0x00000000065FE000-memory.dmpFilesize
120KB
-
memory/220-97-0x0000000074560000-0x0000000074D10000-memory.dmpFilesize
7.7MB
-
memory/220-91-0x00000000076B0000-0x00000000076B8000-memory.dmpFilesize
32KB
-
memory/220-90-0x00000000076D0000-0x00000000076EA000-memory.dmpFilesize
104KB
-
memory/220-89-0x00000000075D0000-0x00000000075E4000-memory.dmpFilesize
80KB
-
memory/220-16-0x0000000002730000-0x0000000002766000-memory.dmpFilesize
216KB
-
memory/220-17-0x0000000074560000-0x0000000074D10000-memory.dmpFilesize
7.7MB
-
memory/220-18-0x0000000004D10000-0x0000000004D20000-memory.dmpFilesize
64KB
-
memory/220-19-0x0000000005350000-0x0000000005978000-memory.dmpFilesize
6.2MB
-
memory/220-88-0x00000000075C0000-0x00000000075CE000-memory.dmpFilesize
56KB
-
memory/220-86-0x0000000007610000-0x00000000076A6000-memory.dmpFilesize
600KB
-
memory/220-22-0x0000000004D10000-0x0000000004D20000-memory.dmpFilesize
64KB
-
memory/220-56-0x0000000074DC0000-0x0000000074E0C000-memory.dmpFilesize
304KB
-
memory/220-84-0x0000000007390000-0x00000000073AA000-memory.dmpFilesize
104KB
-
memory/220-79-0x0000000007280000-0x0000000007323000-memory.dmpFilesize
652KB
-
memory/220-78-0x0000000004D10000-0x0000000004D20000-memory.dmpFilesize
64KB
-
memory/220-55-0x000000007F8B0000-0x000000007F8C0000-memory.dmpFilesize
64KB
-
memory/220-81-0x0000000004D10000-0x0000000004D20000-memory.dmpFilesize
64KB
-
memory/220-48-0x0000000005BD0000-0x0000000005F24000-memory.dmpFilesize
3.3MB
-
memory/220-52-0x0000000006060000-0x000000000607E000-memory.dmpFilesize
120KB
-
memory/220-25-0x00000000050A0000-0x00000000050C2000-memory.dmpFilesize
136KB
-
memory/1072-51-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/1072-49-0x0000000074560000-0x0000000074D10000-memory.dmpFilesize
7.7MB
-
memory/1072-28-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1072-99-0x0000000006670000-0x00000000066C0000-memory.dmpFilesize
320KB
-
memory/1072-100-0x0000000074560000-0x0000000074D10000-memory.dmpFilesize
7.7MB
-
memory/1072-101-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/2932-50-0x0000000074560000-0x0000000074D10000-memory.dmpFilesize
7.7MB
-
memory/2932-11-0x0000000004F40000-0x0000000004F50000-memory.dmpFilesize
64KB
-
memory/2932-6-0x0000000005600000-0x0000000005620000-memory.dmpFilesize
128KB
-
memory/2932-7-0x00000000061E0000-0x00000000061F4000-memory.dmpFilesize
80KB
-
memory/2932-5-0x0000000005170000-0x000000000517A000-memory.dmpFilesize
40KB
-
memory/2932-8-0x0000000008EA0000-0x0000000008F22000-memory.dmpFilesize
520KB
-
memory/2932-3-0x0000000004FA0000-0x0000000005032000-memory.dmpFilesize
584KB
-
memory/2932-0-0x0000000000510000-0x00000000005D4000-memory.dmpFilesize
784KB
-
memory/2932-2-0x0000000005630000-0x0000000005BD4000-memory.dmpFilesize
5.6MB
-
memory/2932-1-0x0000000074560000-0x0000000074D10000-memory.dmpFilesize
7.7MB
-
memory/2932-4-0x0000000004F40000-0x0000000004F50000-memory.dmpFilesize
64KB
-
memory/2932-9-0x000000000BFC0000-0x000000000C05C000-memory.dmpFilesize
624KB
-
memory/2932-10-0x0000000074560000-0x0000000074D10000-memory.dmpFilesize
7.7MB
-
memory/3008-26-0x0000000005720000-0x0000000005786000-memory.dmpFilesize
408KB
-
memory/3008-20-0x0000000074560000-0x0000000074D10000-memory.dmpFilesize
7.7MB
-
memory/3008-87-0x00000000073F0000-0x0000000007401000-memory.dmpFilesize
68KB
-
memory/3008-21-0x0000000004900000-0x0000000004910000-memory.dmpFilesize
64KB
-
memory/3008-23-0x0000000004900000-0x0000000004910000-memory.dmpFilesize
64KB
-
memory/3008-27-0x0000000005880000-0x00000000058E6000-memory.dmpFilesize
408KB
-
memory/3008-68-0x0000000074DC0000-0x0000000074E0C000-memory.dmpFilesize
304KB
-
memory/3008-80-0x0000000004900000-0x0000000004910000-memory.dmpFilesize
64KB
-
memory/3008-98-0x0000000074560000-0x0000000074D10000-memory.dmpFilesize
7.7MB
-
memory/3008-53-0x0000000005EC0000-0x0000000005F0C000-memory.dmpFilesize
304KB
-
memory/3008-66-0x000000007F860000-0x000000007F870000-memory.dmpFilesize
64KB
-
memory/3008-82-0x0000000004900000-0x0000000004910000-memory.dmpFilesize
64KB