Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

7ae3eb9667...6a.exe

windows7-x64

10

7ae3eb9667...6a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    134s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/05/2024, 06:53 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7ae3eb9667598b99d881f909bb088454b9b445b1eaa0339491fe819c0bd66f6a.exe

  • Size

    1.0MB

  • MD5

    ec464b21a34272867fe025654c86ac27

  • SHA1

    83e97301902aba916b74f8d7716b67eabd093132

  • SHA256

    7ae3eb9667598b99d881f909bb088454b9b445b1eaa0339491fe819c0bd66f6a

  • SHA512

    1a0d1d343a2654928f4cd5ec8c512626a801c3c61459840707e5fe590fd47f7bfaf7f3871d31fd654e4e9a3431cbfb2c3610373bd095619926fda5823889026a

  • SSDEEP

    24576:PAHnh+eWsN3skA4RV1Hom2KXMmHaPfl1VwuRlBqA/T5:yh+ZkldoPK8YaPtzwYH

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.oasisvviss.com
  • Port:
    587
  • Username:
    wn.chong@oasisvviss.com
  • Password:
    !BEaPOL7
  • Email To:
    wn.chong@oasisvviss.com

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ae3eb9667598b99d881f909bb088454b9b445b1eaa0339491fe819c0bd66f6a.exe
    "C:\Users\Admin\AppData\Local\Temp\7ae3eb9667598b99d881f909bb088454b9b445b1eaa0339491fe819c0bd66f6a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\7ae3eb9667598b99d881f909bb088454b9b445b1eaa0339491fe819c0bd66f6a.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2004

Network

  • flag-us
    DNS
    api.ipify.org
    RegSvcs.exe
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN A
    104.26.12.205
    api.ipify.org
    IN A
    104.26.13.205
    api.ipify.org
    IN A
    172.67.74.152
  • flag-us
    GET
    https://api.ipify.org/
    RegSvcs.exe
    Remote address:
    104.26.12.205:443
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
    Host: api.ipify.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 11 May 2024 06:53:50 GMT
    Content-Type: text/plain
    Content-Length: 14
    Connection: keep-alive
    Vary: Origin
    CF-Cache-Status: DYNAMIC
    Server: cloudflare
    CF-RAY: 88204114af476355-LHR
  • flag-us
    DNS
    smtp.oasisvviss.com
    RegSvcs.exe
    Remote address:
    8.8.8.8:53
    Request
    smtp.oasisvviss.com
    IN A
    Response
    smtp.oasisvviss.com
    IN CNAME
    us2.smtp.mailhostbox.com
    us2.smtp.mailhostbox.com
    IN A
    208.91.199.223
    us2.smtp.mailhostbox.com
    IN A
    208.91.199.224
    us2.smtp.mailhostbox.com
    IN A
    208.91.198.143
    us2.smtp.mailhostbox.com
    IN A
    208.91.199.225
  • 104.26.12.205:443
    https://api.ipify.org/
    tls, http
    RegSvcs.exe
    1.0kB
     5.7kB
     11
    11

    HTTP Request

    GET https://api.ipify.org/

    HTTP Response

    200
  • 208.91.199.223:587
    smtp.oasisvviss.com
    RegSvcs.exe
    152 B
     3
  • 208.91.199.224:587
    smtp.oasisvviss.com
    RegSvcs.exe
    152 B
     3
  • 208.91.198.143:587
    smtp.oasisvviss.com
    RegSvcs.exe
    152 B
     3
  • 208.91.199.225:587
    smtp.oasisvviss.com
    RegSvcs.exe
    152 B
     3
  • 208.91.199.223:587
    smtp.oasisvviss.com
    RegSvcs.exe
    152 B
     3
  • 208.91.199.224:587
    smtp.oasisvviss.com
    RegSvcs.exe
    152 B
     3
  • 208.91.198.143:587
    smtp.oasisvviss.com
    RegSvcs.exe
    152 B
     3
  • 8.8.8.8:53
    api.ipify.org
    dns
    RegSvcs.exe
    59 B
     107 B
     1
    1

    DNS Request

    api.ipify.org

    DNS Response

    104.26.12.205
    104.26.13.205
    172.67.74.152

  • 8.8.8.8:53
    smtp.oasisvviss.com
    dns
    RegSvcs.exe
    65 B
     164 B
     1
    1

    DNS Request

    smtp.oasisvviss.com

    DNS Response

    208.91.199.223
    208.91.199.224
    208.91.198.143
    208.91.199.225

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2004-11-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

    Download

  • memory/2004-13-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

    Download

  • memory/2004-15-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

    Download

  • memory/2004-16-0x00000000744CE000-0x00000000744CF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2004-17-0x00000000744C0000-0x0000000074BAE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2004-18-0x00000000744CE000-0x00000000744CF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2004-19-0x00000000744C0000-0x0000000074BAE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2140-10-0x0000000000260000-0x0000000000264000-memory.dmp

    Filesize

    16KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.