Analysis
-
max time kernel
94s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2024 01:26
Static task
static1
Behavioral task
behavioral1
Sample
425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe
Resource
win10v2004-20240426-en
General
-
Target
425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe
-
Size
702KB
-
MD5
0ae3be6ea4ceb4073ef7ad1d5247bb5d
-
SHA1
b2de2a1aafb1b129dce329a2db32c2f830869774
-
SHA256
425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2
-
SHA512
569cc4b2046761000fd3f6979c26ebbfe1dd44be16466f1b63720b7a1302e95c3b1e4696071196743afd98d2908ad494e6a47c46ef15c1b9cf725a30beb0d725
-
SSDEEP
12288:xKeo/lTsCv4IbCB778QexVyEZ7HxjbWr9xUOvzbVNnBFDilYa8QuPjWCRC5ZDmsr:weo/mBkp9oX3NNnBElYsurWks+J
Malware Config
Extracted
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
eddie101
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
eddie101 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 19 api.ipify.org 20 api.ipify.org 21 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exedescription pid process target process PID 3328 set thread context of 2696 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exepowershell.exepowershell.exe425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exepid process 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe 612 powershell.exe 1920 powershell.exe 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe 2696 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe 2696 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe 1920 powershell.exe 612 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exepowershell.exepowershell.exe425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exedescription pid process Token: SeDebugPrivilege 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe Token: SeDebugPrivilege 612 powershell.exe Token: SeDebugPrivilege 1920 powershell.exe Token: SeDebugPrivilege 2696 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exepid process 2696 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exedescription pid process target process PID 3328 wrote to memory of 612 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe powershell.exe PID 3328 wrote to memory of 612 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe powershell.exe PID 3328 wrote to memory of 612 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe powershell.exe PID 3328 wrote to memory of 1920 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe powershell.exe PID 3328 wrote to memory of 1920 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe powershell.exe PID 3328 wrote to memory of 1920 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe powershell.exe PID 3328 wrote to memory of 4068 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe schtasks.exe PID 3328 wrote to memory of 4068 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe schtasks.exe PID 3328 wrote to memory of 4068 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe schtasks.exe PID 3328 wrote to memory of 2696 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe PID 3328 wrote to memory of 2696 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe PID 3328 wrote to memory of 2696 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe PID 3328 wrote to memory of 2696 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe PID 3328 wrote to memory of 2696 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe PID 3328 wrote to memory of 2696 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe PID 3328 wrote to memory of 2696 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe PID 3328 wrote to memory of 2696 3328 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe 425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe"C:\Users\Admin\AppData\Local\Temp\425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PEXYsaogXDNu.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PEXYsaogXDNu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp689D.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe"C:\Users\Admin\AppData\Local\Temp\425856aa2d467f7791d8ce95226af053b364badc273d23956b912352a2864cc2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD554fafff3e0ecd18a27dec320b44165cc
SHA1108089c329ed8cf962a4a3b185665d3a6b7f74dd
SHA256348b1c3fa605f585ce6e1e2f8550e5844eb0417172fd921e79d6d2f46e560164
SHA5120c4b53abb00b60d4e438afc11cde3595031e567bdbe9303ace489faa06d4e497d5f6e2b088fc5b71372febb748495d1e715221d1f3b7e2b0092fb38d3e57affd
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xqhsvsh1.rf5.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp689D.tmpFilesize
1KB
MD548ac3e6720fdd4e8b6605b38949ec886
SHA1109e43b2b6b6436a2db7631604eaf1c617ff2730
SHA256a7d0d77594e1cbd1c00fbf38126c2a90e09cef77c7460aa903252e5637318a66
SHA512a831216d13b01fffaae11cf957cdf687bc9ee2430f1ee9a2f123dbe9fa8077bfd3fdfb99f97a3c874c3d18186e9d79c31b26d3e06df0f421d0eff7bee749c694
-
memory/612-24-0x00000000058D0000-0x0000000005936000-memory.dmpFilesize
408KB
-
memory/612-27-0x0000000005B30000-0x0000000005E84000-memory.dmpFilesize
3.3MB
-
memory/612-23-0x00000000051A0000-0x00000000051C2000-memory.dmpFilesize
136KB
-
memory/612-86-0x0000000075200000-0x00000000759B0000-memory.dmpFilesize
7.7MB
-
memory/612-81-0x00000000077A0000-0x00000000077A8000-memory.dmpFilesize
32KB
-
memory/612-79-0x00000000076C0000-0x00000000076D4000-memory.dmpFilesize
80KB
-
memory/612-78-0x00000000076B0000-0x00000000076BE000-memory.dmpFilesize
56KB
-
memory/612-15-0x0000000004BC0000-0x0000000004BF6000-memory.dmpFilesize
216KB
-
memory/612-17-0x0000000075200000-0x00000000759B0000-memory.dmpFilesize
7.7MB
-
memory/612-18-0x0000000002850000-0x0000000002860000-memory.dmpFilesize
64KB
-
memory/612-16-0x0000000005230000-0x0000000005858000-memory.dmpFilesize
6.2MB
-
memory/612-19-0x0000000002850000-0x0000000002860000-memory.dmpFilesize
64KB
-
memory/612-77-0x0000000007680000-0x0000000007691000-memory.dmpFilesize
68KB
-
memory/612-74-0x0000000007480000-0x000000000749A000-memory.dmpFilesize
104KB
-
memory/612-62-0x00000000718D0000-0x000000007191C000-memory.dmpFilesize
304KB
-
memory/612-49-0x0000000006170000-0x00000000061BC000-memory.dmpFilesize
304KB
-
memory/612-25-0x0000000005A40000-0x0000000005AA6000-memory.dmpFilesize
408KB
-
memory/1920-75-0x00000000071B0000-0x00000000071BA000-memory.dmpFilesize
40KB
-
memory/1920-73-0x0000000007780000-0x0000000007DFA000-memory.dmpFilesize
6.5MB
-
memory/1920-80-0x0000000007480000-0x000000000749A000-memory.dmpFilesize
104KB
-
memory/1920-88-0x0000000075200000-0x00000000759B0000-memory.dmpFilesize
7.7MB
-
memory/1920-76-0x00000000073C0000-0x0000000007456000-memory.dmpFilesize
600KB
-
memory/1920-22-0x0000000000C00000-0x0000000000C10000-memory.dmpFilesize
64KB
-
memory/1920-48-0x0000000005E20000-0x0000000005E3E000-memory.dmpFilesize
120KB
-
memory/1920-50-0x0000000006420000-0x0000000006452000-memory.dmpFilesize
200KB
-
memory/1920-51-0x00000000718D0000-0x000000007191C000-memory.dmpFilesize
304KB
-
memory/1920-61-0x00000000063E0000-0x00000000063FE000-memory.dmpFilesize
120KB
-
memory/1920-72-0x0000000006E50000-0x0000000006EF3000-memory.dmpFilesize
652KB
-
memory/1920-21-0x0000000075200000-0x00000000759B0000-memory.dmpFilesize
7.7MB
-
memory/2696-26-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/2696-89-0x00000000069F0000-0x0000000006A40000-memory.dmpFilesize
320KB
-
memory/3328-9-0x0000000006B60000-0x0000000006BE6000-memory.dmpFilesize
536KB
-
memory/3328-7-0x0000000005E30000-0x0000000005E3E000-memory.dmpFilesize
56KB
-
memory/3328-4-0x0000000005760000-0x0000000005770000-memory.dmpFilesize
64KB
-
memory/3328-10-0x0000000009200000-0x000000000929C000-memory.dmpFilesize
624KB
-
memory/3328-5-0x0000000005850000-0x000000000585A000-memory.dmpFilesize
40KB
-
memory/3328-3-0x0000000005780000-0x0000000005812000-memory.dmpFilesize
584KB
-
memory/3328-8-0x0000000006AD0000-0x0000000006AE6000-memory.dmpFilesize
88KB
-
memory/3328-47-0x0000000075200000-0x00000000759B0000-memory.dmpFilesize
7.7MB
-
memory/3328-2-0x0000000005E40000-0x00000000063E4000-memory.dmpFilesize
5.6MB
-
memory/3328-1-0x0000000075200000-0x00000000759B0000-memory.dmpFilesize
7.7MB
-
memory/3328-6-0x0000000005B70000-0x0000000005B88000-memory.dmpFilesize
96KB
-
memory/3328-0-0x0000000000CF0000-0x0000000000DA6000-memory.dmpFilesize
728KB