Analysis
-
max time kernel
120s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 12:46
Static task
static1
Behavioral task
behavioral1
Sample
5021036673.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5021036673.exe
Resource
win10v2004-20240426-en
General
-
Target
5021036673.exe
-
Size
461KB
-
MD5
3b7ef5232e11bd43c48fbbcbaada35ab
-
SHA1
04c1003f6611b769fc7f900d404ac90d550a12ac
-
SHA256
8476500f6ecba15ee6e50f37c34bf2ccdd4790b42d0a44737d2626dcaa0e2449
-
SHA512
ef397e10b854bc6ba465717ef7686de5caab0fdd81b8758c89764cdba5e3b058d621562fac2bc3dd59d89e59e44579029b2cc21013bff691b0f88cb72665b9df
-
SSDEEP
6144:DVwYYaG3c+iS3oBIOokpsEjb2SfjNhuthxCCfBjhpH3565Xnnz/84DP7/V:r+bOxpsUiS7TutDCVF
Malware Config
Extracted
Protocol: smtp- Host:
66.29.151.236 - Port:
587 - Username:
[email protected] - Password:
s9jjoVvaZchS
Extracted
agenttesla
Protocol: smtp- Host:
66.29.151.236 - Port:
587 - Username:
[email protected] - Password:
s9jjoVvaZchS - Email To:
[email protected]
Extracted
nanocore
1.2.2.0
94.156.68.219:2323
687022d0-91f8-4a5a-bf22-c3a2c043d015
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2024-03-02T10:05:36.450504536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2323
-
default_group
21may04
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
687022d0-91f8-4a5a-bf22-c3a2c043d015
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
94.156.68.219
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5021036673.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation 5021036673.exe -
Executes dropped EXE 1 IoCs
Processes:
Pgfmnlkveb.exepid process 4736 Pgfmnlkveb.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5021036673.exePgfmnlkveb.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\notepads = "C:\\Users\\Admin\\AppData\\Roaming\\notepads.exe" 5021036673.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\notepads = "C:\\Users\\Admin\\AppData\\Roaming\\notepads.exe" Pgfmnlkveb.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 50 api.ipify.org 51 api.ipify.org -
Suspicious use of SetThreadContext 2 IoCs
Processes:
5021036673.exePgfmnlkveb.exedescription pid process target process PID 848 set thread context of 4360 848 5021036673.exe 5021036673.exe PID 4736 set thread context of 216 4736 Pgfmnlkveb.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
5021036673.exeRegAsm.exepid process 4360 5021036673.exe 4360 5021036673.exe 216 RegAsm.exe 216 RegAsm.exe 216 RegAsm.exe 216 RegAsm.exe 216 RegAsm.exe 216 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 216 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
5021036673.exePgfmnlkveb.exe5021036673.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 848 5021036673.exe Token: SeDebugPrivilege 4736 Pgfmnlkveb.exe Token: SeDebugPrivilege 848 5021036673.exe Token: SeDebugPrivilege 4360 5021036673.exe Token: SeDebugPrivilege 4736 Pgfmnlkveb.exe Token: SeDebugPrivilege 216 RegAsm.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
5021036673.exePgfmnlkveb.exedescription pid process target process PID 848 wrote to memory of 4736 848 5021036673.exe Pgfmnlkveb.exe PID 848 wrote to memory of 4736 848 5021036673.exe Pgfmnlkveb.exe PID 848 wrote to memory of 4736 848 5021036673.exe Pgfmnlkveb.exe PID 848 wrote to memory of 4360 848 5021036673.exe 5021036673.exe PID 848 wrote to memory of 4360 848 5021036673.exe 5021036673.exe PID 848 wrote to memory of 4360 848 5021036673.exe 5021036673.exe PID 848 wrote to memory of 4360 848 5021036673.exe 5021036673.exe PID 848 wrote to memory of 4360 848 5021036673.exe 5021036673.exe PID 848 wrote to memory of 4360 848 5021036673.exe 5021036673.exe PID 848 wrote to memory of 4360 848 5021036673.exe 5021036673.exe PID 848 wrote to memory of 4360 848 5021036673.exe 5021036673.exe PID 4736 wrote to memory of 216 4736 Pgfmnlkveb.exe RegAsm.exe PID 4736 wrote to memory of 216 4736 Pgfmnlkveb.exe RegAsm.exe PID 4736 wrote to memory of 216 4736 Pgfmnlkveb.exe RegAsm.exe PID 4736 wrote to memory of 216 4736 Pgfmnlkveb.exe RegAsm.exe PID 4736 wrote to memory of 216 4736 Pgfmnlkveb.exe RegAsm.exe PID 4736 wrote to memory of 216 4736 Pgfmnlkveb.exe RegAsm.exe PID 4736 wrote to memory of 216 4736 Pgfmnlkveb.exe RegAsm.exe PID 4736 wrote to memory of 216 4736 Pgfmnlkveb.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5021036673.exe"C:\Users\Admin\AppData\Local\Temp\5021036673.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Pgfmnlkveb.exe"C:\Users\Admin\AppData\Local\Temp\Pgfmnlkveb.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\5021036673.exe"C:\Users\Admin\AppData\Local\Temp\5021036673.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5021036673.exe.logFilesize
1KB
MD5489c7565f9b029ba9fadff774073cc98
SHA156c05089b33ee7e7dfa9e6a2d098164efd8e1150
SHA25610bf6242da02dad8b2e1208b9dab9a7303cf986320e05e5ef20b99c9b71326d4
SHA512ddea09c011a8d4f85905842c2f34c98add0110a0b6b3b2709718c3614a2c42dec5f4f5d5b9442cfd3c6c23e9a90c8c0b25c14c3dbd42faea9cc8dd232cace1ac
-
C:\Users\Admin\AppData\Local\Temp\Pgfmnlkveb.exeFilesize
461KB
MD53096b4b10cadb369dfe4bf9baeb90fb9
SHA19c4901dd318cb7aa215b5b9729c368d0567cc42c
SHA2567369e401e7fc860dca295f09625f4ef16235db5cad392e1c6ab4607c22b729dd
SHA51249297c01ade6fcf408e2defc6f143ca7db2822acd2d2a9d9614e2272f7df02d64d815f262d158441c695769ae917a5a9216b86185377e817ce2f980f688c84f8
-
\??\c:\users\admin\appdata\roaming\notepads.exeFilesize
128KB
MD5e97516890aa76265224a63c87784e51b
SHA1732a1646b65e83bed1c14be1c0edf24dcc9c35ed
SHA2562aa5a386b24d6a80e6bdc9465c312a11ebbf9ec968f4047e992f5d478be77d05
SHA512d76a2e97f03bd57d21f094c62661218dd12d8a238eba7c865c55af2aba93dd725961eae9a2ee953b9211dcf5902f8c716543af4cba356291cec020eaaa2cdc20
-
memory/216-9833-0x00000000063C0000-0x00000000063CE000-memory.dmpFilesize
56KB
-
memory/216-9830-0x0000000006390000-0x000000000639E000-memory.dmpFilesize
56KB
-
memory/216-9835-0x00000000063E0000-0x00000000063F0000-memory.dmpFilesize
64KB
-
memory/216-9832-0x00000000063B0000-0x00000000063BC000-memory.dmpFilesize
48KB
-
memory/216-9834-0x00000000063D0000-0x00000000063E4000-memory.dmpFilesize
80KB
-
memory/216-9837-0x0000000006420000-0x000000000642E000-memory.dmpFilesize
56KB
-
memory/216-9831-0x00000000063A0000-0x00000000063B2000-memory.dmpFilesize
72KB
-
memory/216-9836-0x0000000006400000-0x0000000006414000-memory.dmpFilesize
80KB
-
memory/216-9829-0x0000000006360000-0x000000000637A000-memory.dmpFilesize
104KB
-
memory/216-9828-0x0000000006350000-0x0000000006362000-memory.dmpFilesize
72KB
-
memory/216-9825-0x0000000005E30000-0x0000000005E3A000-memory.dmpFilesize
40KB
-
memory/216-9824-0x0000000005BF0000-0x0000000005C0E000-memory.dmpFilesize
120KB
-
memory/216-9823-0x00000000052B0000-0x00000000052BA000-memory.dmpFilesize
40KB
-
memory/216-9821-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/216-9838-0x0000000006430000-0x000000000645E000-memory.dmpFilesize
184KB
-
memory/216-9839-0x0000000006460000-0x0000000006474000-memory.dmpFilesize
80KB
-
memory/848-4892-0x00000000059F0000-0x0000000005A8C000-memory.dmpFilesize
624KB
-
memory/848-49-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-37-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-35-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-33-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-31-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-29-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-27-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-23-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-21-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-19-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-59-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-57-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-65-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-63-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-61-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-67-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-15-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-9-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-4890-0x0000000075220000-0x00000000759D0000-memory.dmpFilesize
7.7MB
-
memory/848-4891-0x00000000059C0000-0x00000000059C6000-memory.dmpFilesize
24KB
-
memory/848-43-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-4893-0x0000000005A90000-0x0000000005ADC000-memory.dmpFilesize
304KB
-
memory/848-4894-0x000000007522E000-0x000000007522F000-memory.dmpFilesize
4KB
-
memory/848-4895-0x0000000075220000-0x00000000759D0000-memory.dmpFilesize
7.7MB
-
memory/848-4896-0x0000000075220000-0x00000000759D0000-memory.dmpFilesize
7.7MB
-
memory/848-4909-0x0000000006A90000-0x0000000007034000-memory.dmpFilesize
5.6MB
-
memory/848-4910-0x0000000005850000-0x00000000058A4000-memory.dmpFilesize
336KB
-
memory/848-4917-0x0000000075220000-0x00000000759D0000-memory.dmpFilesize
7.7MB
-
memory/848-0-0x000000007522E000-0x000000007522F000-memory.dmpFilesize
4KB
-
memory/848-45-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-1-0x00000000005E0000-0x0000000000656000-memory.dmpFilesize
472KB
-
memory/848-2-0x0000000075220000-0x00000000759D0000-memory.dmpFilesize
7.7MB
-
memory/848-3-0x00000000084C0000-0x0000000008720000-memory.dmpFilesize
2.4MB
-
memory/848-5-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-4-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-7-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-11-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-13-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-17-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-25-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-41-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-55-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-53-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-51-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-47-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/848-39-0x00000000084C0000-0x0000000008719000-memory.dmpFilesize
2.3MB
-
memory/4360-4922-0x00000000065D0000-0x000000000666C000-memory.dmpFilesize
624KB
-
memory/4360-4916-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/4360-9814-0x0000000075220000-0x00000000759D0000-memory.dmpFilesize
7.7MB
-
memory/4360-4918-0x0000000075220000-0x00000000759D0000-memory.dmpFilesize
7.7MB
-
memory/4360-4919-0x00000000050F0000-0x0000000005156000-memory.dmpFilesize
408KB
-
memory/4360-5006-0x0000000006710000-0x00000000067A2000-memory.dmpFilesize
584KB
-
memory/4360-5007-0x00000000066A0000-0x00000000066AA000-memory.dmpFilesize
40KB
-
memory/4360-4920-0x0000000075220000-0x00000000759D0000-memory.dmpFilesize
7.7MB
-
memory/4360-4921-0x00000000064E0000-0x0000000006530000-memory.dmpFilesize
320KB
-
memory/4736-9812-0x0000000005340000-0x0000000005346000-memory.dmpFilesize
24KB
-
memory/4736-4908-0x00000000001D0000-0x0000000000246000-memory.dmpFilesize
472KB
-
memory/4736-4911-0x0000000075220000-0x00000000759D0000-memory.dmpFilesize
7.7MB
-
memory/4736-4923-0x0000000007F70000-0x00000000081B2000-memory.dmpFilesize
2.3MB
-
memory/4736-9820-0x0000000075220000-0x00000000759D0000-memory.dmpFilesize
7.7MB
-
memory/4736-9813-0x0000000005410000-0x000000000548E000-memory.dmpFilesize
504KB
-
memory/4736-9815-0x0000000075220000-0x00000000759D0000-memory.dmpFilesize
7.7MB