Analysis
-
max time kernel
140s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 01:49
Static task
static1
Behavioral task
behavioral1
Sample
TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe
Resource
win10v2004-20240508-en
General
-
Target
TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe
-
Size
2.5MB
-
MD5
943b8ec27c9e3997239b317f081ec3e4
-
SHA1
c5d9639dfbda1c3fec0f7e7ff9c27790074c0009
-
SHA256
09ec4ca4e05a633b0a8114607cc08fd062348051d17f745d483cc3646279722b
-
SHA512
7eaf696ca9448de6363903749ef5d3fdb396190b656e8e87f4874a2a00ad19cd5725b072e1514dd90c4ff73eea590629b4e82b5fc084233aba4c44fbde7db490
-
SSDEEP
49152:ZP6hSrcCPT0J5Lg31+mYGnKDkTXzTnSPb:iujmmYGnKDkTzTno
Malware Config
Extracted
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$
Extracted
agenttesla
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TEKLİF TALEP VE FİYAT TEKLİFİsxlx. = "\"C:\\Users\\Admin\\TEKLİF TALEP VE FİYAT TEKLİFİ\u202es\u061cx\u061cl\u061cx\u061c..exe\"" TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exedescription pid process target process PID 2740 set thread context of 4548 2740 TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe jsc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
jsc.exepid process 4548 jsc.exe 4548 jsc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
jsc.exedescription pid process Token: SeDebugPrivilege 4548 jsc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exedescription pid process target process PID 2740 wrote to memory of 4548 2740 TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe jsc.exe PID 2740 wrote to memory of 4548 2740 TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe jsc.exe PID 2740 wrote to memory of 4548 2740 TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe jsc.exe PID 2740 wrote to memory of 4548 2740 TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe jsc.exe PID 2740 wrote to memory of 4548 2740 TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe jsc.exe PID 2740 wrote to memory of 4548 2740 TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe jsc.exe PID 2740 wrote to memory of 4548 2740 TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe jsc.exe PID 2740 wrote to memory of 4548 2740 TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe jsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe"C:\Users\Admin\AppData\Local\Temp\TEKLİF TALEP VE FİYAT TEKLİFİsxlx..exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4548-1-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4548-2-0x0000000074B6E000-0x0000000074B6F000-memory.dmpFilesize
4KB
-
memory/4548-3-0x0000000005E60000-0x0000000006404000-memory.dmpFilesize
5.6MB
-
memory/4548-4-0x0000000005920000-0x0000000005986000-memory.dmpFilesize
408KB
-
memory/4548-5-0x0000000074B60000-0x0000000075310000-memory.dmpFilesize
7.7MB
-
memory/4548-6-0x0000000006840000-0x0000000006890000-memory.dmpFilesize
320KB
-
memory/4548-7-0x0000000006930000-0x00000000069CC000-memory.dmpFilesize
624KB
-
memory/4548-8-0x0000000006DF0000-0x0000000006E82000-memory.dmpFilesize
584KB
-
memory/4548-9-0x0000000006DA0000-0x0000000006DAA000-memory.dmpFilesize
40KB
-
memory/4548-10-0x0000000074B6E000-0x0000000074B6F000-memory.dmpFilesize
4KB
-
memory/4548-11-0x0000000074B60000-0x0000000075310000-memory.dmpFilesize
7.7MB