Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29-04-2024 11:06
Static task
static1
Behavioral task
behavioral1
Sample
SOA.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
SOA.exe
Resource
win10v2004-20240426-en
General
-
Target
SOA.exe
-
Size
668KB
-
MD5
1b3feb610357e53c06656f8f084b7fe8
-
SHA1
135db2eecfdf9ec9f9a0a8ee5efe777e0f68437c
-
SHA256
530b019d1e22535451dbefd997a09c85eeeaa313b114c67ab67329d5fe14e8fc
-
SHA512
1773aceba4bcf0ac857a26240d63b0d700cd4a2d56e4984f3c9479653601ff737a438e97b7abc75c640c9a82665092a4d751968b9a90ac25b5f5cc6d86526ff8
-
SSDEEP
12288:24B778Q+A/y4Zz/LQglOYiZmxjIw3jbOFu5mQf0MiZA+tlEXF4xAKkR:PB1/LMYiZ884guyN3QXF4WJ
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.vpindustries.co.in - Port:
587 - Username:
[email protected] - Password:
saleS*9988 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SOA.exedescription pid process target process PID 2936 set thread context of 2676 2936 SOA.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
SOA.exepowershell.exepowershell.exeRegSvcs.exepid process 2936 SOA.exe 2936 SOA.exe 2936 SOA.exe 2936 SOA.exe 2936 SOA.exe 2936 SOA.exe 2540 powershell.exe 2660 powershell.exe 2936 SOA.exe 2676 RegSvcs.exe 2676 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
SOA.exepowershell.exepowershell.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2936 SOA.exe Token: SeDebugPrivilege 2540 powershell.exe Token: SeDebugPrivilege 2660 powershell.exe Token: SeDebugPrivilege 2676 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
SOA.exedescription pid process target process PID 2936 wrote to memory of 2540 2936 SOA.exe powershell.exe PID 2936 wrote to memory of 2540 2936 SOA.exe powershell.exe PID 2936 wrote to memory of 2540 2936 SOA.exe powershell.exe PID 2936 wrote to memory of 2540 2936 SOA.exe powershell.exe PID 2936 wrote to memory of 2660 2936 SOA.exe powershell.exe PID 2936 wrote to memory of 2660 2936 SOA.exe powershell.exe PID 2936 wrote to memory of 2660 2936 SOA.exe powershell.exe PID 2936 wrote to memory of 2660 2936 SOA.exe powershell.exe PID 2936 wrote to memory of 2584 2936 SOA.exe schtasks.exe PID 2936 wrote to memory of 2584 2936 SOA.exe schtasks.exe PID 2936 wrote to memory of 2584 2936 SOA.exe schtasks.exe PID 2936 wrote to memory of 2584 2936 SOA.exe schtasks.exe PID 2936 wrote to memory of 2676 2936 SOA.exe RegSvcs.exe PID 2936 wrote to memory of 2676 2936 SOA.exe RegSvcs.exe PID 2936 wrote to memory of 2676 2936 SOA.exe RegSvcs.exe PID 2936 wrote to memory of 2676 2936 SOA.exe RegSvcs.exe PID 2936 wrote to memory of 2676 2936 SOA.exe RegSvcs.exe PID 2936 wrote to memory of 2676 2936 SOA.exe RegSvcs.exe PID 2936 wrote to memory of 2676 2936 SOA.exe RegSvcs.exe PID 2936 wrote to memory of 2676 2936 SOA.exe RegSvcs.exe PID 2936 wrote to memory of 2676 2936 SOA.exe RegSvcs.exe PID 2936 wrote to memory of 2676 2936 SOA.exe RegSvcs.exe PID 2936 wrote to memory of 2676 2936 SOA.exe RegSvcs.exe PID 2936 wrote to memory of 2676 2936 SOA.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"C:\Users\Admin\AppData\Local\Temp\SOA.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SOA.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RGziIWDEowC.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RGziIWDEowC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp699C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp699C.tmpFilesize
1KB
MD5a411b945f58924148a07aadab3c9d352
SHA19a1a27068eda258da05839c33691364fc0c924e1
SHA256c4e006838992ed5207957cf3f124b4f265780599628f774c6c2f4d0ac581322b
SHA51221f1b5217b99a9ddc3a40f6f62234134a31f945dcff4b41901e9282cb21b994d02f083eb4e0c2274aa399e917884880715ea32df9183cfebb35a2c57e1ba8165
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SO4BTLIS6Q27L4UONW3I.tempFilesize
7KB
MD5272a308435d9a513b8b26b813fce1a1e
SHA1acb7f1345c8d46dd9c2d4e84687864ce22ddbd24
SHA256a86e05f7b234d92776453f456a2cd5d1b5bae7126febcd0bd91fd3e2f56da781
SHA5122210abde935f27de489f17f4a065e5943a4171db4f3a52e9dc19487a263a2e4de25be537e30f294d18fcee67ddf2dd246a9479f94eff6996b43e780c5e3deaa8
-
memory/2676-29-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2676-21-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2676-23-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2676-25-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2676-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2676-28-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2676-31-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2676-19-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2936-6-0x0000000004E10000-0x0000000004E94000-memory.dmpFilesize
528KB
-
memory/2936-1-0x0000000074D90000-0x000000007547E000-memory.dmpFilesize
6.9MB
-
memory/2936-0-0x0000000000960000-0x0000000000A0A000-memory.dmpFilesize
680KB
-
memory/2936-2-0x0000000000260000-0x00000000002A0000-memory.dmpFilesize
256KB
-
memory/2936-3-0x00000000004C0000-0x00000000004D8000-memory.dmpFilesize
96KB
-
memory/2936-5-0x00000000004F0000-0x0000000000506000-memory.dmpFilesize
88KB
-
memory/2936-4-0x00000000004E0000-0x00000000004EE000-memory.dmpFilesize
56KB
-
memory/2936-32-0x0000000074D90000-0x000000007547E000-memory.dmpFilesize
6.9MB