Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order-504789923/ABjGK9XeRxzJ33W.exe
Resource
win7-20240220-en
General
-
Target
Purchase Order-504789923/ABjGK9XeRxzJ33W.exe
-
Size
855KB
-
MD5
23603bfafc152b25980d9d2daf1a7eb7
-
SHA1
ad240c8ff5e81a18f6c71f0392c8e1b0bf96bf87
-
SHA256
bfd3502d2fa81b4e82c6d0f35da6ae508c5be2b83342cc564ede8e50b580f875
-
SHA512
ff262a11a4d3ffdb1ae97f5f07b9e09a2b9deb9baa9aeaed52624e5dc1a5394a61aa20979ab7d95f0572f34f4e301e0dda7d4353f7088b8964b31059bd0a1cba
-
SSDEEP
24576:GWtb3BEyS/eRwgblVA3LIRJPfSWUhh2l:VZBEnxIlVwcRp
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
webmail.thestore99.shop - Port:
587 - Username:
[email protected] - Password:
@thestore99.shop - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2624 powershell.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2280 set thread context of 2676 2280 ABjGK9XeRxzJ33W.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2508 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2280 ABjGK9XeRxzJ33W.exe 2280 ABjGK9XeRxzJ33W.exe 2676 ABjGK9XeRxzJ33W.exe 2676 ABjGK9XeRxzJ33W.exe 2624 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2280 ABjGK9XeRxzJ33W.exe Token: SeDebugPrivilege 2676 ABjGK9XeRxzJ33W.exe Token: SeDebugPrivilege 2624 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2624 2280 ABjGK9XeRxzJ33W.exe 28 PID 2280 wrote to memory of 2624 2280 ABjGK9XeRxzJ33W.exe 28 PID 2280 wrote to memory of 2624 2280 ABjGK9XeRxzJ33W.exe 28 PID 2280 wrote to memory of 2624 2280 ABjGK9XeRxzJ33W.exe 28 PID 2280 wrote to memory of 2508 2280 ABjGK9XeRxzJ33W.exe 30 PID 2280 wrote to memory of 2508 2280 ABjGK9XeRxzJ33W.exe 30 PID 2280 wrote to memory of 2508 2280 ABjGK9XeRxzJ33W.exe 30 PID 2280 wrote to memory of 2508 2280 ABjGK9XeRxzJ33W.exe 30 PID 2280 wrote to memory of 2676 2280 ABjGK9XeRxzJ33W.exe 32 PID 2280 wrote to memory of 2676 2280 ABjGK9XeRxzJ33W.exe 32 PID 2280 wrote to memory of 2676 2280 ABjGK9XeRxzJ33W.exe 32 PID 2280 wrote to memory of 2676 2280 ABjGK9XeRxzJ33W.exe 32 PID 2280 wrote to memory of 2676 2280 ABjGK9XeRxzJ33W.exe 32 PID 2280 wrote to memory of 2676 2280 ABjGK9XeRxzJ33W.exe 32 PID 2280 wrote to memory of 2676 2280 ABjGK9XeRxzJ33W.exe 32 PID 2280 wrote to memory of 2676 2280 ABjGK9XeRxzJ33W.exe 32 PID 2280 wrote to memory of 2676 2280 ABjGK9XeRxzJ33W.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order-504789923\ABjGK9XeRxzJ33W.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order-504789923\ABjGK9XeRxzJ33W.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZgyPhDuHCFbHKh.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZgyPhDuHCFbHKh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2839.tmp"2⤵
- Creates scheduled task(s)
PID:2508
-
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order-504789923\ABjGK9XeRxzJ33W.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order-504789923\ABjGK9XeRxzJ33W.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD595aa74771475a6af14c3b1d9da1ddab5
SHA166fbecb9add63eb56b4364ffd88539870d7151fa
SHA256253c7c5fdf553ca5c874079b5919dd4eceae56e2f543a43a67d2349713e61cb9
SHA5129b784fb0aea363a4f53e29bb767a794e53678714359e1e1864f138f86dd2f66dabe4b4d220da3594a6d4b3b14231988603e11eca6d7196d9d955611a8e77a165