Overview

overview

10

Static

static

3

9d18f6e382...8a.exe

windows7-x64

10

9d18f6e382...8a.exe

windows10-2004-x64

10

Deposit pa...DF.exe

windows7-x64

10

Deposit pa...DF.exe

windows10-2004-x64

10

e787e9b3eb...eb.exe

windows7-x64

10

e787e9b3eb...eb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08073ae9508ee5a7ebfd44efd2ba95d47d5356998c19f4204c93165195cc9bc0

  • Size

    2.0MB

  • Sample

    240504-besg4acc29

  • MD5

    f748f9a2292b97e80d50ee13aedcdc82

  • SHA1

    dd6dc3ff3414dee7dc672a58a10df080fe14436c

  • SHA256

    08073ae9508ee5a7ebfd44efd2ba95d47d5356998c19f4204c93165195cc9bc0

  • SHA512

    434dc172b09d213c717875c391613e6a74be334186702db054af3f8e9552fb44b0f79f206160c79e5e7d386060f1496fef81f6e3ae101ac3e9aa5907194c2472

  • SSDEEP

    49152:8rIlxrwfCa2uqiUfOXe9jlOokB2/HFCi/m79:7Eaa2uqJfye9jlOokB2/lCi/6

Score
10/10
agentteslasmokeloaderpub3backdoorexecutionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.cojosem.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ZARHLOULBOSS123

Extracted

Family

smokeloader

Version

2022

C2

http://cellc.org/tmp/index.php

http://h-c-v.ru/tmp/index.php

http://icebrasilpr.com/tmp/index.php

http://piratia-life.ru/tmp/index.php

http://piratia.su/tmp/index.php
rc4.i32
rc4.i32

Extracted

Family

smokeloader

Botnet

pub3

Targets

    • Target

      9d18f6e38273eb6a8959627210f55baf459975af7a75195e108613bfd3da858a.exe

    • Size

      704KB

    • MD5

      eabe9b55aaf1f35048b4512f2dbd9a44

    • SHA1

      53b1b9d51a39892cf1e2a2075aa671dbeb096135

    • SHA256

      9d18f6e38273eb6a8959627210f55baf459975af7a75195e108613bfd3da858a

    • SHA512

      c430e17de378489fc17844a046f4d72d6adad909c1387e3f6f0a106783918d1819dcd70451e6b0ddd42aa51e14b7eee931654d908c9adf9985b7fac567eceece

    • SSDEEP

      12288:LXUeoUNewB351Us8jhHnK0rxw90reDXxRWzUmFurkCGUymKIEmNvUXX2tHl0fl3+:d1dfZSK0FioeVcQkCwmomRUHAl0fl3

    Score
    10/10
    agentteslaexecutionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      Deposit payment copy PDF.exe

    • Size

      704KB

    • MD5

      eabe9b55aaf1f35048b4512f2dbd9a44

    • SHA1

      53b1b9d51a39892cf1e2a2075aa671dbeb096135

    • SHA256

      9d18f6e38273eb6a8959627210f55baf459975af7a75195e108613bfd3da858a

    • SHA512

      c430e17de378489fc17844a046f4d72d6adad909c1387e3f6f0a106783918d1819dcd70451e6b0ddd42aa51e14b7eee931654d908c9adf9985b7fac567eceece

    • SSDEEP

      12288:LXUeoUNewB351Us8jhHnK0rxw90reDXxRWzUmFurkCGUymKIEmNvUXX2tHl0fl3+:d1dfZSK0FioeVcQkCwmomRUHAl0fl3

    Score
    10/10
    agentteslaexecutionkeyloggerpersistencespywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

    • Target

      e787e9b3eb07676a4848cb9ff1dad9a19a5b3aa11a220b2ba3d447ac6680abeb.exe

    • Size

      734KB

    • MD5

      0c4cb8fd1e3cc4b42556562d317e6e59

    • SHA1

      8a572e6ef21e54b76cf0b38099c6ca47d607170e

    • SHA256

      e787e9b3eb07676a4848cb9ff1dad9a19a5b3aa11a220b2ba3d447ac6680abeb

    • SHA512

      0b7c6520fe39261743cb6f85a601d9e7306a17e25b1909150a14cd4e31e5c2d9c0faef30effbd1dc1eb1108da53b0f6284d701ce37ab5cef5dbcf9a2f8634652

    • SSDEEP

      12288:dXxKusPyZi+9cn2eIIcXopkUxTBdmEkH1Vmkw8dUfmBpHG9Yg1p8mgNahqYSkjQH:dXxKusaZi+9pI3xl1u1q/fmpnepSzYSr

    Score
    10/10
    smokeloaderbackdoortrojanpub3

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

2
T1059.001

Scheduled Task/Job

2
T1053

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Scheduled Task/Job

2
T1053

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Scheduled Task/Job

2
T1053

Defense Evasion

Modify Registry

3
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Query Registry

5
T1012

System Information Discovery

7
T1082

Peripheral Device Discovery

1
T1120

Process Discovery

1
T1057

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks