Analysis
-
max time kernel
120s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 03:43
Static task
static1
Behavioral task
behavioral1
Sample
garanti odeme200524.scr.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
garanti odeme200524.scr.exe
Resource
win10v2004-20240508-en
General
-
Target
garanti odeme200524.scr.exe
-
Size
713KB
-
MD5
a68f9e8fe3a6b2a073267af477c2bf31
-
SHA1
96a682c454cfb32ae2928801e89e67b043e47a4e
-
SHA256
4da3b16ba44f07d99f82116f4a316e47d83862e575a6e4185f504d52e69cc6f5
-
SHA512
4e283db9f2f7f013b34e37755005f8eea84153d74b3eed513a07fd97ac3bf11c805d4c34ecd68320defe194fde3fb19bd2ff7759659d75dc703bfc51645a60eb
-
SSDEEP
12288:dU9jA6JPQbRhkYvg86stzDpi4L3HIb66KWlyaiZAuW1md+:AbsPTL3HIb66rsUD
Malware Config
Extracted
Protocol: smtp- Host:
mail.avtorska.com.mk - Port:
587 - Username:
[email protected] - Password:
avtorska2014@
Extracted
agenttesla
Protocol: smtp- Host:
mail.avtorska.com.mk - Port:
587 - Username:
[email protected] - Password:
avtorska2014@ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\skype = "C:\\Users\\Admin\\AppData\\Roaming\\skype\\skype.exe" RegAsm.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org 6 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2076 set thread context of 2600 2076 garanti odeme200524.scr.exe 29 -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2076 garanti odeme200524.scr.exe 2076 garanti odeme200524.scr.exe 2076 garanti odeme200524.scr.exe 2076 garanti odeme200524.scr.exe 2076 garanti odeme200524.scr.exe 2600 RegAsm.exe 2600 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2076 garanti odeme200524.scr.exe Token: SeDebugPrivilege 2600 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2600 RegAsm.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2076 wrote to memory of 3028 2076 garanti odeme200524.scr.exe 28 PID 2076 wrote to memory of 3028 2076 garanti odeme200524.scr.exe 28 PID 2076 wrote to memory of 3028 2076 garanti odeme200524.scr.exe 28 PID 2076 wrote to memory of 3028 2076 garanti odeme200524.scr.exe 28 PID 2076 wrote to memory of 3028 2076 garanti odeme200524.scr.exe 28 PID 2076 wrote to memory of 3028 2076 garanti odeme200524.scr.exe 28 PID 2076 wrote to memory of 3028 2076 garanti odeme200524.scr.exe 28 PID 2076 wrote to memory of 3028 2076 garanti odeme200524.scr.exe 28 PID 2076 wrote to memory of 3028 2076 garanti odeme200524.scr.exe 28 PID 2076 wrote to memory of 3028 2076 garanti odeme200524.scr.exe 28 PID 2076 wrote to memory of 3028 2076 garanti odeme200524.scr.exe 28 PID 2076 wrote to memory of 3028 2076 garanti odeme200524.scr.exe 28 PID 2076 wrote to memory of 2600 2076 garanti odeme200524.scr.exe 29 PID 2076 wrote to memory of 2600 2076 garanti odeme200524.scr.exe 29 PID 2076 wrote to memory of 2600 2076 garanti odeme200524.scr.exe 29 PID 2076 wrote to memory of 2600 2076 garanti odeme200524.scr.exe 29 PID 2076 wrote to memory of 2600 2076 garanti odeme200524.scr.exe 29 PID 2076 wrote to memory of 2600 2076 garanti odeme200524.scr.exe 29 PID 2076 wrote to memory of 2600 2076 garanti odeme200524.scr.exe 29 PID 2076 wrote to memory of 2600 2076 garanti odeme200524.scr.exe 29 PID 2076 wrote to memory of 2600 2076 garanti odeme200524.scr.exe 29 PID 2076 wrote to memory of 2600 2076 garanti odeme200524.scr.exe 29 PID 2076 wrote to memory of 2600 2076 garanti odeme200524.scr.exe 29 PID 2076 wrote to memory of 2600 2076 garanti odeme200524.scr.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\garanti odeme200524.scr.exe"C:\Users\Admin\AppData\Local\Temp\garanti odeme200524.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3028
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a