Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 12:46
Static task
static1
Behavioral task
behavioral1
Sample
5021036673.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
5021036673.exe
Resource
win10v2004-20240426-en
General
-
Target
5021036673.exe
-
Size
461KB
-
MD5
3b7ef5232e11bd43c48fbbcbaada35ab
-
SHA1
04c1003f6611b769fc7f900d404ac90d550a12ac
-
SHA256
8476500f6ecba15ee6e50f37c34bf2ccdd4790b42d0a44737d2626dcaa0e2449
-
SHA512
ef397e10b854bc6ba465717ef7686de5caab0fdd81b8758c89764cdba5e3b058d621562fac2bc3dd59d89e59e44579029b2cc21013bff691b0f88cb72665b9df
-
SSDEEP
6144:DVwYYaG3c+iS3oBIOokpsEjb2SfjNhuthxCCfBjhpH3565Xnnz/84DP7/V:r+bOxpsUiS7TutDCVF
Malware Config
Extracted
Protocol: smtp- Host:
66.29.151.236 - Port:
587 - Username:
[email protected] - Password:
s9jjoVvaZchS
Extracted
agenttesla
Protocol: smtp- Host:
66.29.151.236 - Port:
587 - Username:
[email protected] - Password:
s9jjoVvaZchS - Email To:
[email protected]
Extracted
nanocore
1.2.2.0
94.156.68.219:2323
687022d0-91f8-4a5a-bf22-c3a2c043d015
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2024-03-02T10:05:36.450504536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2323
-
default_group
21may04
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
687022d0-91f8-4a5a-bf22-c3a2c043d015
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
94.156.68.219
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5021036673.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation 5021036673.exe -
Executes dropped EXE 1 IoCs
Processes:
Pgfmnlkveb.exepid process 4480 Pgfmnlkveb.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5021036673.exePgfmnlkveb.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\notepads = "C:\\Users\\Admin\\AppData\\Roaming\\notepads.exe" 5021036673.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\notepads = "C:\\Users\\Admin\\AppData\\Roaming\\notepads.exe" Pgfmnlkveb.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 34 api.ipify.org 35 api.ipify.org -
Suspicious use of SetThreadContext 2 IoCs
Processes:
5021036673.exePgfmnlkveb.exedescription pid process target process PID 372 set thread context of 1140 372 5021036673.exe 5021036673.exe PID 4480 set thread context of 2212 4480 Pgfmnlkveb.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
5021036673.exeRegAsm.exepid process 1140 5021036673.exe 1140 5021036673.exe 2212 RegAsm.exe 2212 RegAsm.exe 2212 RegAsm.exe 2212 RegAsm.exe 2212 RegAsm.exe 2212 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 2212 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
5021036673.exePgfmnlkveb.exe5021036673.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 372 5021036673.exe Token: SeDebugPrivilege 372 5021036673.exe Token: SeDebugPrivilege 4480 Pgfmnlkveb.exe Token: SeDebugPrivilege 1140 5021036673.exe Token: SeDebugPrivilege 4480 Pgfmnlkveb.exe Token: SeDebugPrivilege 2212 RegAsm.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
5021036673.exePgfmnlkveb.exedescription pid process target process PID 372 wrote to memory of 4480 372 5021036673.exe Pgfmnlkveb.exe PID 372 wrote to memory of 4480 372 5021036673.exe Pgfmnlkveb.exe PID 372 wrote to memory of 4480 372 5021036673.exe Pgfmnlkveb.exe PID 372 wrote to memory of 1140 372 5021036673.exe 5021036673.exe PID 372 wrote to memory of 1140 372 5021036673.exe 5021036673.exe PID 372 wrote to memory of 1140 372 5021036673.exe 5021036673.exe PID 372 wrote to memory of 1140 372 5021036673.exe 5021036673.exe PID 372 wrote to memory of 1140 372 5021036673.exe 5021036673.exe PID 372 wrote to memory of 1140 372 5021036673.exe 5021036673.exe PID 372 wrote to memory of 1140 372 5021036673.exe 5021036673.exe PID 372 wrote to memory of 1140 372 5021036673.exe 5021036673.exe PID 4480 wrote to memory of 2212 4480 Pgfmnlkveb.exe RegAsm.exe PID 4480 wrote to memory of 2212 4480 Pgfmnlkveb.exe RegAsm.exe PID 4480 wrote to memory of 2212 4480 Pgfmnlkveb.exe RegAsm.exe PID 4480 wrote to memory of 2212 4480 Pgfmnlkveb.exe RegAsm.exe PID 4480 wrote to memory of 2212 4480 Pgfmnlkveb.exe RegAsm.exe PID 4480 wrote to memory of 2212 4480 Pgfmnlkveb.exe RegAsm.exe PID 4480 wrote to memory of 2212 4480 Pgfmnlkveb.exe RegAsm.exe PID 4480 wrote to memory of 2212 4480 Pgfmnlkveb.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5021036673.exe"C:\Users\Admin\AppData\Local\Temp\5021036673.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Pgfmnlkveb.exe"C:\Users\Admin\AppData\Local\Temp\Pgfmnlkveb.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\5021036673.exe"C:\Users\Admin\AppData\Local\Temp\5021036673.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5021036673.exe.logFilesize
1KB
MD5489c7565f9b029ba9fadff774073cc98
SHA156c05089b33ee7e7dfa9e6a2d098164efd8e1150
SHA25610bf6242da02dad8b2e1208b9dab9a7303cf986320e05e5ef20b99c9b71326d4
SHA512ddea09c011a8d4f85905842c2f34c98add0110a0b6b3b2709718c3614a2c42dec5f4f5d5b9442cfd3c6c23e9a90c8c0b25c14c3dbd42faea9cc8dd232cace1ac
-
C:\Users\Admin\AppData\Local\Temp\Pgfmnlkveb.exeFilesize
461KB
MD53096b4b10cadb369dfe4bf9baeb90fb9
SHA19c4901dd318cb7aa215b5b9729c368d0567cc42c
SHA2567369e401e7fc860dca295f09625f4ef16235db5cad392e1c6ab4607c22b729dd
SHA51249297c01ade6fcf408e2defc6f143ca7db2822acd2d2a9d9614e2272f7df02d64d815f262d158441c695769ae917a5a9216b86185377e817ce2f980f688c84f8
-
\??\c:\users\admin\appdata\roaming\notepads.exeFilesize
320KB
MD5d267fe0c0089f85f9d047fd58936dccb
SHA1977c496b19e303d4e72dccaa67b9071becb54469
SHA25640379d7b6b69626509a77cb803da09c64097db6488eb1f3c93036b9d6b38af84
SHA51202bb736eab8e9a10a560a47f095a9f83bd553c58f2e31e81790336d30731b3d2c9351223c459c1c04a4c9333e870a655a33934b5109b897db256eca86cccc76e
-
memory/372-4891-0x0000000005CC0000-0x0000000005CC6000-memory.dmpFilesize
24KB
-
memory/372-4892-0x0000000005CF0000-0x0000000005D8C000-memory.dmpFilesize
624KB
-
memory/372-3-0x00000000087C0000-0x0000000008A20000-memory.dmpFilesize
2.4MB
-
memory/372-5-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-9-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-51-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-53-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-47-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-45-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-41-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-39-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-37-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-35-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-33-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-31-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-29-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-25-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-49-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-43-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-27-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-23-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-19-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-17-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-15-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-13-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-11-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-7-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-21-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-4-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-67-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-65-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-63-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-61-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-59-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-57-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-55-0x00000000087C0000-0x0000000008A19000-memory.dmpFilesize
2.3MB
-
memory/372-4890-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/372-1-0x00000000008E0000-0x0000000000956000-memory.dmpFilesize
472KB
-
memory/372-4909-0x0000000006B90000-0x0000000007134000-memory.dmpFilesize
5.6MB
-
memory/372-4893-0x0000000005D90000-0x0000000005DDC000-memory.dmpFilesize
304KB
-
memory/372-2-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/372-4895-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/372-4896-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/372-4910-0x0000000001270000-0x00000000012C4000-memory.dmpFilesize
336KB
-
memory/372-4894-0x00000000745DE000-0x00000000745DF000-memory.dmpFilesize
4KB
-
memory/372-4918-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/372-0-0x00000000745DE000-0x00000000745DF000-memory.dmpFilesize
4KB
-
memory/1140-5745-0x00000000063F0000-0x0000000006482000-memory.dmpFilesize
584KB
-
memory/1140-4920-0x0000000004DD0000-0x0000000004E36000-memory.dmpFilesize
408KB
-
memory/1140-4921-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/1140-4917-0x0000000000610000-0x0000000000652000-memory.dmpFilesize
264KB
-
memory/1140-4923-0x00000000062B0000-0x000000000634C000-memory.dmpFilesize
624KB
-
memory/1140-5746-0x0000000006380000-0x000000000638A000-memory.dmpFilesize
40KB
-
memory/1140-4919-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/1140-4922-0x00000000061C0000-0x0000000006210000-memory.dmpFilesize
320KB
-
memory/1140-9816-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/2212-9832-0x0000000006BB0000-0x0000000006BC2000-memory.dmpFilesize
72KB
-
memory/2212-9833-0x0000000006BC0000-0x0000000006BCC000-memory.dmpFilesize
48KB
-
memory/2212-9840-0x0000000006C70000-0x0000000006C84000-memory.dmpFilesize
80KB
-
memory/2212-9839-0x0000000006C40000-0x0000000006C6E000-memory.dmpFilesize
184KB
-
memory/2212-9838-0x0000000006C30000-0x0000000006C3E000-memory.dmpFilesize
56KB
-
memory/2212-9822-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2212-9837-0x0000000006C10000-0x0000000006C24000-memory.dmpFilesize
80KB
-
memory/2212-9836-0x0000000006BF0000-0x0000000006C00000-memory.dmpFilesize
64KB
-
memory/2212-9835-0x0000000006BE0000-0x0000000006BF4000-memory.dmpFilesize
80KB
-
memory/2212-9824-0x0000000005780000-0x000000000578A000-memory.dmpFilesize
40KB
-
memory/2212-9825-0x00000000059F0000-0x0000000005A0E000-memory.dmpFilesize
120KB
-
memory/2212-9826-0x0000000005B60000-0x0000000005B6A000-memory.dmpFilesize
40KB
-
memory/2212-9829-0x0000000005B80000-0x0000000005B92000-memory.dmpFilesize
72KB
-
memory/2212-9830-0x0000000006B70000-0x0000000006B8A000-memory.dmpFilesize
104KB
-
memory/2212-9831-0x0000000006BA0000-0x0000000006BAE000-memory.dmpFilesize
56KB
-
memory/2212-9834-0x0000000006BD0000-0x0000000006BDE000-memory.dmpFilesize
56KB
-
memory/4480-4924-0x0000000007190000-0x00000000073D2000-memory.dmpFilesize
2.3MB
-
memory/4480-9821-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/4480-4908-0x0000000000650000-0x00000000006C6000-memory.dmpFilesize
472KB
-
memory/4480-4911-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/4480-4912-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/4480-9815-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/4480-9813-0x00000000057C0000-0x00000000057C6000-memory.dmpFilesize
24KB
-
memory/4480-9814-0x00000000058A0000-0x000000000591E000-memory.dmpFilesize
504KB