Analysis
-
max time kernel
140s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 03:43
Static task
static1
Behavioral task
behavioral1
Sample
FaturaBildirim.exe
Resource
win7-20240508-en
General
-
Target
FaturaBildirim.exe
-
Size
676KB
-
MD5
c7be962ea1dde7fb4ae315d7c69a7988
-
SHA1
a24475c78c57873d495f4bcb14b71246e050add6
-
SHA256
179e544a547fd06c8af3d0aa5160448c1acf22e0d0343832097788d916051570
-
SHA512
6546d783142c3b7db898d67dd74413c7bf675b8837bb07100849d2160d8a7773e6d843cb69f8c1ead1025a9a0e407b03573ff0e05ca1cb5fc5e18909861d8d26
-
SSDEEP
12288:olYifTSceFntlMDfhbnOn+jcfwi+jh7dMLB4M/qFHpEDepHz8M4H0GHhkR:nilItlIVe+ZiQB6/qFwEw8
Malware Config
Extracted
Protocol: smtp- Host:
zqamcx.com - Port:
587 - Username:
[email protected] - Password:
Methodman991
Extracted
agenttesla
Protocol: smtp- Host:
zqamcx.com - Port:
587 - Username:
[email protected] - Password:
Methodman991 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3424 powershell.exe 1576 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation FaturaBildirim.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 768 set thread context of 3452 768 FaturaBildirim.exe 113 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4192 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 768 FaturaBildirim.exe 768 FaturaBildirim.exe 768 FaturaBildirim.exe 768 FaturaBildirim.exe 768 FaturaBildirim.exe 768 FaturaBildirim.exe 768 FaturaBildirim.exe 768 FaturaBildirim.exe 768 FaturaBildirim.exe 768 FaturaBildirim.exe 768 FaturaBildirim.exe 768 FaturaBildirim.exe 768 FaturaBildirim.exe 768 FaturaBildirim.exe 768 FaturaBildirim.exe 768 FaturaBildirim.exe 768 FaturaBildirim.exe 768 FaturaBildirim.exe 768 FaturaBildirim.exe 3424 powershell.exe 3424 powershell.exe 1576 powershell.exe 1576 powershell.exe 768 FaturaBildirim.exe 3452 FaturaBildirim.exe 3452 FaturaBildirim.exe 3452 FaturaBildirim.exe 3424 powershell.exe 1576 powershell.exe 3452 FaturaBildirim.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 768 FaturaBildirim.exe Token: SeDebugPrivilege 3424 powershell.exe Token: SeDebugPrivilege 1576 powershell.exe Token: SeDebugPrivilege 3452 FaturaBildirim.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3452 FaturaBildirim.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 768 wrote to memory of 3424 768 FaturaBildirim.exe 107 PID 768 wrote to memory of 3424 768 FaturaBildirim.exe 107 PID 768 wrote to memory of 3424 768 FaturaBildirim.exe 107 PID 768 wrote to memory of 1576 768 FaturaBildirim.exe 109 PID 768 wrote to memory of 1576 768 FaturaBildirim.exe 109 PID 768 wrote to memory of 1576 768 FaturaBildirim.exe 109 PID 768 wrote to memory of 4192 768 FaturaBildirim.exe 111 PID 768 wrote to memory of 4192 768 FaturaBildirim.exe 111 PID 768 wrote to memory of 4192 768 FaturaBildirim.exe 111 PID 768 wrote to memory of 3452 768 FaturaBildirim.exe 113 PID 768 wrote to memory of 3452 768 FaturaBildirim.exe 113 PID 768 wrote to memory of 3452 768 FaturaBildirim.exe 113 PID 768 wrote to memory of 3452 768 FaturaBildirim.exe 113 PID 768 wrote to memory of 3452 768 FaturaBildirim.exe 113 PID 768 wrote to memory of 3452 768 FaturaBildirim.exe 113 PID 768 wrote to memory of 3452 768 FaturaBildirim.exe 113 PID 768 wrote to memory of 3452 768 FaturaBildirim.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\FaturaBildirim.exe"C:\Users\Admin\AppData\Local\Temp\FaturaBildirim.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FaturaBildirim.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3424
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\apqOjuQgh.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1576
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\apqOjuQgh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9834.tmp"2⤵
- Creates scheduled task(s)
PID:4192
-
-
C:\Users\Admin\AppData\Local\Temp\FaturaBildirim.exe"C:\Users\Admin\AppData\Local\Temp\FaturaBildirim.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1392,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:81⤵PID:4316
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD50f93b2128f7c7d7d131082de6833d966
SHA1509013dcabf3a1f6542c31e4ac3ee10fe01c7b83
SHA2561a88a3bd38bb60d0f0d7099b725e1de572a5cb8bfd5a930385b8bd312662a38b
SHA5129989ae79c373b2134580d64466c29ba088cf55124717496798e55ae2d2f74e903f1320fe9b70d9e16c558f5e8d2bee2e554a0ab831e78315562049f12d34be5f