Analysis
-
max time kernel
122s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 12:46
Static task
static1
Behavioral task
behavioral1
Sample
5021036673.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5021036673.exe
Resource
win10v2004-20240426-en
General
-
Target
5021036673.exe
-
Size
461KB
-
MD5
3b7ef5232e11bd43c48fbbcbaada35ab
-
SHA1
04c1003f6611b769fc7f900d404ac90d550a12ac
-
SHA256
8476500f6ecba15ee6e50f37c34bf2ccdd4790b42d0a44737d2626dcaa0e2449
-
SHA512
ef397e10b854bc6ba465717ef7686de5caab0fdd81b8758c89764cdba5e3b058d621562fac2bc3dd59d89e59e44579029b2cc21013bff691b0f88cb72665b9df
-
SSDEEP
6144:DVwYYaG3c+iS3oBIOokpsEjb2SfjNhuthxCCfBjhpH3565Xnnz/84DP7/V:r+bOxpsUiS7TutDCVF
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
66.29.151.236 - Port:
587 - Username:
[email protected] - Password:
s9jjoVvaZchS - Email To:
[email protected]
Extracted
nanocore
1.2.2.0
94.156.68.219:2323
687022d0-91f8-4a5a-bf22-c3a2c043d015
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2024-03-02T10:05:36.450504536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2323
-
default_group
21may04
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
687022d0-91f8-4a5a-bf22-c3a2c043d015
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
94.156.68.219
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE 1 IoCs
Processes:
Pgfmnlkveb.exepid process 2436 Pgfmnlkveb.exe -
Loads dropped DLL 1 IoCs
Processes:
5021036673.exepid process 112 5021036673.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5021036673.exePgfmnlkveb.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\notepads = "C:\\Users\\Admin\\AppData\\Roaming\\notepads.exe" 5021036673.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\notepads = "C:\\Users\\Admin\\AppData\\Roaming\\notepads.exe" Pgfmnlkveb.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 api.ipify.org 9 api.ipify.org -
Suspicious use of SetThreadContext 2 IoCs
Processes:
5021036673.exePgfmnlkveb.exedescription pid process target process PID 112 set thread context of 728 112 5021036673.exe 5021036673.exe PID 2436 set thread context of 3412 2436 Pgfmnlkveb.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
5021036673.exeRegAsm.exepid process 728 5021036673.exe 728 5021036673.exe 3412 RegAsm.exe 3412 RegAsm.exe 3412 RegAsm.exe 3412 RegAsm.exe 3412 RegAsm.exe 3412 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 3412 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
5021036673.exePgfmnlkveb.exe5021036673.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 112 5021036673.exe Token: SeDebugPrivilege 2436 Pgfmnlkveb.exe Token: SeDebugPrivilege 112 5021036673.exe Token: SeDebugPrivilege 728 5021036673.exe Token: SeDebugPrivilege 2436 Pgfmnlkveb.exe Token: SeDebugPrivilege 3412 RegAsm.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
5021036673.exePgfmnlkveb.exedescription pid process target process PID 112 wrote to memory of 2436 112 5021036673.exe Pgfmnlkveb.exe PID 112 wrote to memory of 2436 112 5021036673.exe Pgfmnlkveb.exe PID 112 wrote to memory of 2436 112 5021036673.exe Pgfmnlkveb.exe PID 112 wrote to memory of 2436 112 5021036673.exe Pgfmnlkveb.exe PID 112 wrote to memory of 728 112 5021036673.exe 5021036673.exe PID 112 wrote to memory of 728 112 5021036673.exe 5021036673.exe PID 112 wrote to memory of 728 112 5021036673.exe 5021036673.exe PID 112 wrote to memory of 728 112 5021036673.exe 5021036673.exe PID 112 wrote to memory of 728 112 5021036673.exe 5021036673.exe PID 112 wrote to memory of 728 112 5021036673.exe 5021036673.exe PID 112 wrote to memory of 728 112 5021036673.exe 5021036673.exe PID 112 wrote to memory of 728 112 5021036673.exe 5021036673.exe PID 112 wrote to memory of 728 112 5021036673.exe 5021036673.exe PID 2436 wrote to memory of 3412 2436 Pgfmnlkveb.exe RegAsm.exe PID 2436 wrote to memory of 3412 2436 Pgfmnlkveb.exe RegAsm.exe PID 2436 wrote to memory of 3412 2436 Pgfmnlkveb.exe RegAsm.exe PID 2436 wrote to memory of 3412 2436 Pgfmnlkveb.exe RegAsm.exe PID 2436 wrote to memory of 3412 2436 Pgfmnlkveb.exe RegAsm.exe PID 2436 wrote to memory of 3412 2436 Pgfmnlkveb.exe RegAsm.exe PID 2436 wrote to memory of 3412 2436 Pgfmnlkveb.exe RegAsm.exe PID 2436 wrote to memory of 3412 2436 Pgfmnlkveb.exe RegAsm.exe PID 2436 wrote to memory of 3412 2436 Pgfmnlkveb.exe RegAsm.exe PID 2436 wrote to memory of 3412 2436 Pgfmnlkveb.exe RegAsm.exe PID 2436 wrote to memory of 3412 2436 Pgfmnlkveb.exe RegAsm.exe PID 2436 wrote to memory of 3412 2436 Pgfmnlkveb.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5021036673.exe"C:\Users\Admin\AppData\Local\Temp\5021036673.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Pgfmnlkveb.exe"C:\Users\Admin\AppData\Local\Temp\Pgfmnlkveb.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\5021036673.exe"C:\Users\Admin\AppData\Local\Temp\5021036673.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\c:\users\admin\appdata\roaming\notepads.exeFilesize
461KB
MD509f52399d4182c1fa58298b6998a21b0
SHA150e760ffe5ee0bb4d91abe7241c578793beae5df
SHA256174004c5159a43d394d852ec27034448ed003defc008d308c4a606c3bc84cb17
SHA512e1a64da8e4df6cb9706588f5323dba0e6678c49bc82bf65efa0b56d6c7cf0f1b9b53489f67de99b09e9558288ddb3b54d335ead8132c1640351134880a90db39
-
\Users\Admin\AppData\Local\Temp\Pgfmnlkveb.exeFilesize
461KB
MD53096b4b10cadb369dfe4bf9baeb90fb9
SHA19c4901dd318cb7aa215b5b9729c368d0567cc42c
SHA2567369e401e7fc860dca295f09625f4ef16235db5cad392e1c6ab4607c22b729dd
SHA51249297c01ade6fcf408e2defc6f143ca7db2822acd2d2a9d9614e2272f7df02d64d815f262d158441c695769ae917a5a9216b86185377e817ce2f980f688c84f8
-
memory/112-47-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-13-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-2-0x0000000074CD0000-0x00000000753BE000-memory.dmpFilesize
6.9MB
-
memory/112-3-0x0000000008910000-0x0000000008B70000-memory.dmpFilesize
2.4MB
-
memory/112-4-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-39-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-7-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-9-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-11-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-37-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-15-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-17-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-19-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-21-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-23-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-25-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-27-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-29-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-45-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-67-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-4892-0x0000000002270000-0x00000000022BC000-memory.dmpFilesize
304KB
-
memory/112-4891-0x0000000005760000-0x00000000057FC000-memory.dmpFilesize
624KB
-
memory/112-4890-0x00000000003B0000-0x00000000003B6000-memory.dmpFilesize
24KB
-
memory/112-65-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-63-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-62-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-59-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-57-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-55-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-53-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-51-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-50-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-0-0x0000000074CDE000-0x0000000074CDF000-memory.dmpFilesize
4KB
-
memory/112-43-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-42-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-5-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-1-0x00000000003C0000-0x0000000000436000-memory.dmpFilesize
472KB
-
memory/112-35-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-34-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-32-0x0000000008910000-0x0000000008B69000-memory.dmpFilesize
2.3MB
-
memory/112-4893-0x0000000074CDE000-0x0000000074CDF000-memory.dmpFilesize
4KB
-
memory/112-4894-0x0000000074CD0000-0x00000000753BE000-memory.dmpFilesize
6.9MB
-
memory/112-4904-0x0000000004F90000-0x0000000004FE4000-memory.dmpFilesize
336KB
-
memory/112-4927-0x0000000074CD0000-0x00000000753BE000-memory.dmpFilesize
6.9MB
-
memory/728-4926-0x0000000000080000-0x00000000000C2000-memory.dmpFilesize
264KB
-
memory/2436-4902-0x00000000010F0000-0x0000000001166000-memory.dmpFilesize
472KB
-
memory/2436-4903-0x0000000074CD0000-0x00000000753BE000-memory.dmpFilesize
6.9MB
-
memory/2436-4905-0x0000000074CD0000-0x00000000753BE000-memory.dmpFilesize
6.9MB
-
memory/2436-4928-0x0000000008740000-0x0000000008982000-memory.dmpFilesize
2.3MB
-
memory/2436-9816-0x0000000005660000-0x00000000056DE000-memory.dmpFilesize
504KB
-
memory/2436-9815-0x00000000005D0000-0x00000000005D6000-memory.dmpFilesize
24KB
-
memory/2436-9817-0x0000000074CD0000-0x00000000753BE000-memory.dmpFilesize
6.9MB
-
memory/2436-9832-0x0000000074CD0000-0x00000000753BE000-memory.dmpFilesize
6.9MB
-
memory/3412-9849-0x0000000000DD0000-0x0000000000DDE000-memory.dmpFilesize
56KB
-
memory/3412-9843-0x0000000000A30000-0x0000000000A42000-memory.dmpFilesize
72KB
-
memory/3412-9836-0x0000000000540000-0x000000000055E000-memory.dmpFilesize
120KB
-
memory/3412-9840-0x00000000008A0000-0x00000000008B2000-memory.dmpFilesize
72KB
-
memory/3412-9842-0x0000000000A20000-0x0000000000A2E000-memory.dmpFilesize
56KB
-
memory/3412-9841-0x0000000000A00000-0x0000000000A1A000-memory.dmpFilesize
104KB
-
memory/3412-9833-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3412-9835-0x00000000003D0000-0x00000000003DA000-memory.dmpFilesize
40KB
-
memory/3412-9844-0x0000000000A60000-0x0000000000A6C000-memory.dmpFilesize
48KB
-
memory/3412-9845-0x0000000000C50000-0x0000000000C5E000-memory.dmpFilesize
56KB
-
memory/3412-9846-0x0000000000C60000-0x0000000000C74000-memory.dmpFilesize
80KB
-
memory/3412-9847-0x0000000000C70000-0x0000000000C80000-memory.dmpFilesize
64KB
-
memory/3412-9848-0x0000000000DC0000-0x0000000000DD4000-memory.dmpFilesize
80KB
-
memory/3412-9837-0x00000000003F0000-0x00000000003FA000-memory.dmpFilesize
40KB
-
memory/3412-9850-0x0000000004F50000-0x0000000004F7E000-memory.dmpFilesize
184KB
-
memory/3412-9851-0x0000000000E30000-0x0000000000E44000-memory.dmpFilesize
80KB