Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29-04-2024 17:20
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Heur.25013.20090.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Heur.25013.20090.exe
Resource
win10v2004-20240419-en
General
-
Target
SecuriteInfo.com.Heur.25013.20090.exe
-
Size
631KB
-
MD5
26aa84b983564ccd62143b164ffa7f62
-
SHA1
df39b8d79ca797d9dc594f62d705682b4ec7d634
-
SHA256
3029eb76575a110e9bfeadcee488cb4db00d25da6d8529e48d49f2fee0770f80
-
SHA512
ebc73b0faeb5886ff5910fc69d93293de875098ffb66037508e70f1a8c922312952a5d8341aa856787e4ffa670fc01fb40b288c067dba4aaec5e7c886c74bcf6
-
SSDEEP
12288:mZMAvNlMfHJ2zJWfs+Pk8xVv5x9+AeVmxgU5hT3ETB778Qm:jAw2zJWfs+s8HjnXgWhUTB0
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.starmech.net - Port:
587 - Username:
[email protected] - Password:
nics123 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SecuriteInfo.com.Heur.25013.20090.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.Heur.25013.20090.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SecuriteInfo.com.Heur.25013.20090.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BjTxJte = "C:\\Users\\Admin\\AppData\\Roaming\\BjTxJte\\BjTxJte.exe" SecuriteInfo.com.Heur.25013.20090.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Heur.25013.20090.exedescription pid process target process PID 1924 set thread context of 3632 1924 SecuriteInfo.com.Heur.25013.20090.exe SecuriteInfo.com.Heur.25013.20090.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exepowershell.exeSecuriteInfo.com.Heur.25013.20090.exeSecuriteInfo.com.Heur.25013.20090.exepid process 3732 powershell.exe 1228 powershell.exe 1924 SecuriteInfo.com.Heur.25013.20090.exe 1924 SecuriteInfo.com.Heur.25013.20090.exe 3632 SecuriteInfo.com.Heur.25013.20090.exe 3632 SecuriteInfo.com.Heur.25013.20090.exe 3732 powershell.exe 1228 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exepowershell.exeSecuriteInfo.com.Heur.25013.20090.exeSecuriteInfo.com.Heur.25013.20090.exedescription pid process Token: SeDebugPrivilege 1228 powershell.exe Token: SeDebugPrivilege 3732 powershell.exe Token: SeDebugPrivilege 1924 SecuriteInfo.com.Heur.25013.20090.exe Token: SeDebugPrivilege 3632 SecuriteInfo.com.Heur.25013.20090.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
SecuriteInfo.com.Heur.25013.20090.exepid process 3632 SecuriteInfo.com.Heur.25013.20090.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
SecuriteInfo.com.Heur.25013.20090.exedescription pid process target process PID 1924 wrote to memory of 3732 1924 SecuriteInfo.com.Heur.25013.20090.exe powershell.exe PID 1924 wrote to memory of 3732 1924 SecuriteInfo.com.Heur.25013.20090.exe powershell.exe PID 1924 wrote to memory of 3732 1924 SecuriteInfo.com.Heur.25013.20090.exe powershell.exe PID 1924 wrote to memory of 1228 1924 SecuriteInfo.com.Heur.25013.20090.exe powershell.exe PID 1924 wrote to memory of 1228 1924 SecuriteInfo.com.Heur.25013.20090.exe powershell.exe PID 1924 wrote to memory of 1228 1924 SecuriteInfo.com.Heur.25013.20090.exe powershell.exe PID 1924 wrote to memory of 5008 1924 SecuriteInfo.com.Heur.25013.20090.exe schtasks.exe PID 1924 wrote to memory of 5008 1924 SecuriteInfo.com.Heur.25013.20090.exe schtasks.exe PID 1924 wrote to memory of 5008 1924 SecuriteInfo.com.Heur.25013.20090.exe schtasks.exe PID 1924 wrote to memory of 2956 1924 SecuriteInfo.com.Heur.25013.20090.exe SecuriteInfo.com.Heur.25013.20090.exe PID 1924 wrote to memory of 2956 1924 SecuriteInfo.com.Heur.25013.20090.exe SecuriteInfo.com.Heur.25013.20090.exe PID 1924 wrote to memory of 2956 1924 SecuriteInfo.com.Heur.25013.20090.exe SecuriteInfo.com.Heur.25013.20090.exe PID 1924 wrote to memory of 3632 1924 SecuriteInfo.com.Heur.25013.20090.exe SecuriteInfo.com.Heur.25013.20090.exe PID 1924 wrote to memory of 3632 1924 SecuriteInfo.com.Heur.25013.20090.exe SecuriteInfo.com.Heur.25013.20090.exe PID 1924 wrote to memory of 3632 1924 SecuriteInfo.com.Heur.25013.20090.exe SecuriteInfo.com.Heur.25013.20090.exe PID 1924 wrote to memory of 3632 1924 SecuriteInfo.com.Heur.25013.20090.exe SecuriteInfo.com.Heur.25013.20090.exe PID 1924 wrote to memory of 3632 1924 SecuriteInfo.com.Heur.25013.20090.exe SecuriteInfo.com.Heur.25013.20090.exe PID 1924 wrote to memory of 3632 1924 SecuriteInfo.com.Heur.25013.20090.exe SecuriteInfo.com.Heur.25013.20090.exe PID 1924 wrote to memory of 3632 1924 SecuriteInfo.com.Heur.25013.20090.exe SecuriteInfo.com.Heur.25013.20090.exe PID 1924 wrote to memory of 3632 1924 SecuriteInfo.com.Heur.25013.20090.exe SecuriteInfo.com.Heur.25013.20090.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.25013.20090.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.25013.20090.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.25013.20090.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yNoWANrisVl.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yNoWANrisVl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6590.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.25013.20090.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.25013.20090.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.25013.20090.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.25013.20090.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hxyz21rv.wew.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp6590.tmpFilesize
1KB
MD5625aef52abad885b5add228952cfce31
SHA11e1beaceb15fbcc5fd90a7d0416ff73294da779b
SHA2560a21628d3d045e6295ac1b44d2c886a1fe51ee8c7bc0240710bc456687f94bf7
SHA5120b7717bdda6b7f1c982db6f03f31508cf5976cbc5d604c4fcb3aeab560df67b7d33b89bce0c65d22033ead63bed5aa8248be5df50be3d9132bb7382e844d7096
-
memory/1228-32-0x00000000056E0000-0x0000000005A34000-memory.dmpFilesize
3.3MB
-
memory/1228-63-0x0000000070E60000-0x0000000070EAC000-memory.dmpFilesize
304KB
-
memory/1228-20-0x00000000047F0000-0x0000000004800000-memory.dmpFilesize
64KB
-
memory/1228-75-0x00000000070C0000-0x00000000070DA000-memory.dmpFilesize
104KB
-
memory/1228-82-0x00000000073E0000-0x00000000073E8000-memory.dmpFilesize
32KB
-
memory/1228-77-0x0000000007340000-0x00000000073D6000-memory.dmpFilesize
600KB
-
memory/1228-81-0x0000000007400000-0x000000000741A000-memory.dmpFilesize
104KB
-
memory/1228-78-0x00000000072C0000-0x00000000072D1000-memory.dmpFilesize
68KB
-
memory/1228-26-0x00000000747C0000-0x0000000074F70000-memory.dmpFilesize
7.7MB
-
memory/1228-80-0x0000000007300000-0x0000000007314000-memory.dmpFilesize
80KB
-
memory/1228-86-0x00000000747C0000-0x0000000074F70000-memory.dmpFilesize
7.7MB
-
memory/1228-21-0x00000000047F0000-0x0000000004800000-memory.dmpFilesize
64KB
-
memory/1228-74-0x0000000007700000-0x0000000007D7A000-memory.dmpFilesize
6.5MB
-
memory/1228-49-0x0000000005D30000-0x0000000005D4E000-memory.dmpFilesize
120KB
-
memory/1924-7-0x00000000069C0000-0x00000000069CE000-memory.dmpFilesize
56KB
-
memory/1924-48-0x00000000747C0000-0x0000000074F70000-memory.dmpFilesize
7.7MB
-
memory/1924-10-0x00000000094F0000-0x000000000958C000-memory.dmpFilesize
624KB
-
memory/1924-9-0x0000000006A60000-0x0000000006AE4000-memory.dmpFilesize
528KB
-
memory/1924-8-0x00000000069E0000-0x00000000069F6000-memory.dmpFilesize
88KB
-
memory/1924-2-0x0000000005C10000-0x00000000061B4000-memory.dmpFilesize
5.6MB
-
memory/1924-4-0x0000000005960000-0x0000000005970000-memory.dmpFilesize
64KB
-
memory/1924-5-0x00000000057E0000-0x00000000057EA000-memory.dmpFilesize
40KB
-
memory/1924-1-0x00000000747C0000-0x0000000074F70000-memory.dmpFilesize
7.7MB
-
memory/1924-0-0x0000000000DD0000-0x0000000000E74000-memory.dmpFilesize
656KB
-
memory/1924-3-0x0000000005740000-0x00000000057D2000-memory.dmpFilesize
584KB
-
memory/1924-6-0x0000000007080000-0x0000000007098000-memory.dmpFilesize
96KB
-
memory/3632-46-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/3632-88-0x00000000070F0000-0x0000000007140000-memory.dmpFilesize
320KB
-
memory/3732-24-0x00000000058C0000-0x0000000005926000-memory.dmpFilesize
408KB
-
memory/3732-51-0x0000000006560000-0x0000000006592000-memory.dmpFilesize
200KB
-
memory/3732-62-0x0000000006540000-0x000000000655E000-memory.dmpFilesize
120KB
-
memory/3732-64-0x00000000071A0000-0x0000000007243000-memory.dmpFilesize
652KB
-
memory/3732-52-0x0000000070E60000-0x0000000070EAC000-memory.dmpFilesize
304KB
-
memory/3732-50-0x0000000006050000-0x000000000609C000-memory.dmpFilesize
304KB
-
memory/3732-76-0x0000000007330000-0x000000000733A000-memory.dmpFilesize
40KB
-
memory/3732-23-0x0000000005820000-0x0000000005842000-memory.dmpFilesize
136KB
-
memory/3732-25-0x0000000005930000-0x0000000005996000-memory.dmpFilesize
408KB
-
memory/3732-79-0x00000000074F0000-0x00000000074FE000-memory.dmpFilesize
56KB
-
memory/3732-17-0x00000000747C0000-0x0000000074F70000-memory.dmpFilesize
7.7MB
-
memory/3732-18-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/3732-19-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/3732-85-0x00000000747C0000-0x0000000074F70000-memory.dmpFilesize
7.7MB
-
memory/3732-15-0x00000000049F0000-0x0000000004A26000-memory.dmpFilesize
216KB
-
memory/3732-16-0x00000000051C0000-0x00000000057E8000-memory.dmpFilesize
6.2MB