Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
30-04-2024 01:34
Static task
static1
Behavioral task
behavioral1
Sample
c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe
Resource
win10v2004-20240419-en
General
-
Target
c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe
-
Size
696KB
-
MD5
7ad71dff280a152a659a3e6533f782ad
-
SHA1
8a31b1faefa6ba58b3f244455f2eefc9b90cfc59
-
SHA256
c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa
-
SHA512
8311c1013ae0e516d1ca4ea8af2103f68dfebcc649b2170f3008c5575dc46e702b070182a34a58fd40a6747a2352a3a60d1fa06f8aee8468ee7cd148ad77896f
-
SSDEEP
12288:j+DbgnB778QeV4PEa67uYDjXwp4h77B4N8K8q1hrWDQM+/ED:qgnB25DDzF77BK1haDtf
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.hliaka.gr - Port:
587 - Username:
[email protected] - Password:
!@#hliaka@hliaka!@# - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exedescription pid process target process PID 2184 set thread context of 2376 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exec73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exepowershell.exepowershell.exepid process 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe 2376 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe 2376 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe 1208 powershell.exe 2528 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exec73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe Token: SeDebugPrivilege 2376 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe Token: SeDebugPrivilege 1208 powershell.exe Token: SeDebugPrivilege 2528 powershell.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exedescription pid process target process PID 2184 wrote to memory of 2528 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe powershell.exe PID 2184 wrote to memory of 2528 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe powershell.exe PID 2184 wrote to memory of 2528 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe powershell.exe PID 2184 wrote to memory of 2528 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe powershell.exe PID 2184 wrote to memory of 1208 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe powershell.exe PID 2184 wrote to memory of 1208 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe powershell.exe PID 2184 wrote to memory of 1208 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe powershell.exe PID 2184 wrote to memory of 1208 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe powershell.exe PID 2184 wrote to memory of 1652 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe schtasks.exe PID 2184 wrote to memory of 1652 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe schtasks.exe PID 2184 wrote to memory of 1652 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe schtasks.exe PID 2184 wrote to memory of 1652 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe schtasks.exe PID 2184 wrote to memory of 2376 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe PID 2184 wrote to memory of 2376 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe PID 2184 wrote to memory of 2376 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe PID 2184 wrote to memory of 2376 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe PID 2184 wrote to memory of 2376 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe PID 2184 wrote to memory of 2376 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe PID 2184 wrote to memory of 2376 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe PID 2184 wrote to memory of 2376 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe PID 2184 wrote to memory of 2376 2184 c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe"C:\Users\Admin\AppData\Local\Temp\c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bheCYnawNhl.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bheCYnawNhl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp38BC.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe"C:\Users\Admin\AppData\Local\Temp\c73fabf4588d66f7394e905664c556cb7afd12bd9e05481576c3a97db33c2afa.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp38BC.tmpFilesize
1KB
MD51d562a8ebd84d25a03c15193ef176ac8
SHA1a8bc134c29be67b13009e14d1097916fca2b01f8
SHA2564e4188f4d8dac57106a08b0157cc054dc099b665134fdac53005d701b588e5bc
SHA5125c7cca00f381a3ddffea54375d1a6066886fa77bfa826643f581da7b4d926149ba3b6275a3c08936bd5aff8a1b325707a98f080f0dd7c1e449a02aa0a5417f19
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5ab903161c52efc0ddbf8d0f95c6b04e1
SHA176a829cb66f2386c3e54f74b6ed2a487ddfad384
SHA256f728a9940891aef891a6a85fe03e6ae3aa77c01cfa1d21891491cac02de93a72
SHA5125347b7c261714caa6d8371cb751f23ab7df8c65017d79434e42718d3ccb817271d3e48b7ae509f7023ed25ae889cf847e2d63b4557ab7348f74865bacad83e7f
-
memory/2184-4-0x0000000000700000-0x000000000070E000-memory.dmpFilesize
56KB
-
memory/2184-31-0x0000000074130000-0x000000007481E000-memory.dmpFilesize
6.9MB
-
memory/2184-0-0x0000000000F50000-0x0000000001004000-memory.dmpFilesize
720KB
-
memory/2184-5-0x0000000000720000-0x0000000000736000-memory.dmpFilesize
88KB
-
memory/2184-6-0x00000000047C0000-0x0000000004844000-memory.dmpFilesize
528KB
-
memory/2184-2-0x0000000004D10000-0x0000000004D50000-memory.dmpFilesize
256KB
-
memory/2184-1-0x0000000074130000-0x000000007481E000-memory.dmpFilesize
6.9MB
-
memory/2184-3-0x0000000000690000-0x00000000006A8000-memory.dmpFilesize
96KB
-
memory/2376-19-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2376-29-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2376-30-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2376-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2376-25-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2376-23-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2376-22-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2376-28-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB