Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
sample order quotation.exe
Resource
win7-20240419-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
sample order quotation.exe
Resource
win10v2004-20240426-en
5 signatures
150 seconds
General
-
Target
sample order quotation.exe
-
Size
1.4MB
-
MD5
726c360beafc5735df3048301fccc5b9
-
SHA1
3b9c9c07bfd564ddad935778a24e2c93f8883457
-
SHA256
d91abe1f2c3533430178d0067ffc5ce588d2bd241375179829179c82d39d9e6d
-
SHA512
cac48ab2f722d845bba623f80dcd0856b651e3ec46695dc4efa4f7cbd94d8d877d581001b6d32d14f16628787636537753c418dc27d27e07a5ad2ae6d3c8b9fa
-
SSDEEP
24576:8yLNKjUF+x7f5H6s5K+zzLZYaQer4C/RYhhlBk+hIHDSYWORpHc3gpJ:m8IzLZ9Q04lLOD5WORpkgpJ
Score
10/10
Malware Config
Extracted
Credentials
Protocol: ftp- Host:
associatessystems.com - Port:
21 - Username:
[email protected] - Password:
computer1840
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Port:
587 - Username:
ftp://[email protected] - Password:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3000 set thread context of 2556 3000 sample order quotation.exe 29 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2556 AddInProcess32.exe 2556 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2556 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2556 3000 sample order quotation.exe 29 PID 3000 wrote to memory of 2556 3000 sample order quotation.exe 29 PID 3000 wrote to memory of 2556 3000 sample order quotation.exe 29 PID 3000 wrote to memory of 2556 3000 sample order quotation.exe 29 PID 3000 wrote to memory of 2556 3000 sample order quotation.exe 29 PID 3000 wrote to memory of 2556 3000 sample order quotation.exe 29 PID 3000 wrote to memory of 2556 3000 sample order quotation.exe 29 PID 3000 wrote to memory of 2556 3000 sample order quotation.exe 29 PID 3000 wrote to memory of 2556 3000 sample order quotation.exe 29 PID 3000 wrote to memory of 2664 3000 sample order quotation.exe 30 PID 3000 wrote to memory of 2664 3000 sample order quotation.exe 30 PID 3000 wrote to memory of 2664 3000 sample order quotation.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample order quotation.exe"C:\Users\Admin\AppData\Local\Temp\sample order quotation.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3000 -s 6242⤵PID:2664
-