Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 03:04
Static task
static1
Behavioral task
behavioral1
Sample
SOA APR 24.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
SOA APR 24.exe
Resource
win10v2004-20240508-en
General
-
Target
SOA APR 24.exe
-
Size
670KB
-
MD5
2b12a266317f002c205011fa1958072c
-
SHA1
07e6859611698f37aa9c4011f76907aafe524218
-
SHA256
dff297acb567f990471dca2871adee15229e572c35fef5fd20eb9a1428946c04
-
SHA512
444f0444202f3c4c67cdf3deeb479233041edd4d7a16c0240b729173b5781322278d21abb9e55eb09668795e1121a77ea9ffd11735823a08b109f064969f67b8
-
SSDEEP
12288:J0FJzi8LkpEaAxx1Qy0+9+WTehgXkWP3DdFsOFHplgCIQlHzWH4jdmeO1W+TLTuU:KT2jE3LS7+99fXxP3DdFnFJ2CIQBgcdO
Malware Config
Extracted
Protocol: smtp- Host:
mail.activefreightpak.com - Port:
587 - Username:
[email protected] - Password:
AFSPL**77**
Extracted
agenttesla
Protocol: smtp- Host:
mail.activefreightpak.com - Port:
587 - Username:
[email protected] - Password:
AFSPL**77** - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 3492 powershell.exe 944 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SOA APR 24.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation SOA APR 24.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SOA APR 24.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bnFClsT = "C:\\Users\\Admin\\AppData\\Roaming\\bnFClsT\\bnFClsT.exe" SOA APR 24.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 24 api.ipify.org 25 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SOA APR 24.exedescription pid process target process PID 3104 set thread context of 3456 3104 SOA APR 24.exe SOA APR 24.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
SOA APR 24.exepowershell.exepowershell.exeSOA APR 24.exepid process 3104 SOA APR 24.exe 3492 powershell.exe 944 powershell.exe 3104 SOA APR 24.exe 3104 SOA APR 24.exe 3104 SOA APR 24.exe 3104 SOA APR 24.exe 3104 SOA APR 24.exe 3492 powershell.exe 944 powershell.exe 3456 SOA APR 24.exe 3456 SOA APR 24.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
SOA APR 24.exepowershell.exepowershell.exeSOA APR 24.exedescription pid process Token: SeDebugPrivilege 3104 SOA APR 24.exe Token: SeDebugPrivilege 3492 powershell.exe Token: SeDebugPrivilege 944 powershell.exe Token: SeDebugPrivilege 3456 SOA APR 24.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
SOA APR 24.exepid process 3456 SOA APR 24.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
SOA APR 24.exedescription pid process target process PID 3104 wrote to memory of 3492 3104 SOA APR 24.exe powershell.exe PID 3104 wrote to memory of 3492 3104 SOA APR 24.exe powershell.exe PID 3104 wrote to memory of 3492 3104 SOA APR 24.exe powershell.exe PID 3104 wrote to memory of 944 3104 SOA APR 24.exe powershell.exe PID 3104 wrote to memory of 944 3104 SOA APR 24.exe powershell.exe PID 3104 wrote to memory of 944 3104 SOA APR 24.exe powershell.exe PID 3104 wrote to memory of 1120 3104 SOA APR 24.exe schtasks.exe PID 3104 wrote to memory of 1120 3104 SOA APR 24.exe schtasks.exe PID 3104 wrote to memory of 1120 3104 SOA APR 24.exe schtasks.exe PID 3104 wrote to memory of 2892 3104 SOA APR 24.exe SOA APR 24.exe PID 3104 wrote to memory of 2892 3104 SOA APR 24.exe SOA APR 24.exe PID 3104 wrote to memory of 2892 3104 SOA APR 24.exe SOA APR 24.exe PID 3104 wrote to memory of 2852 3104 SOA APR 24.exe SOA APR 24.exe PID 3104 wrote to memory of 2852 3104 SOA APR 24.exe SOA APR 24.exe PID 3104 wrote to memory of 2852 3104 SOA APR 24.exe SOA APR 24.exe PID 3104 wrote to memory of 3456 3104 SOA APR 24.exe SOA APR 24.exe PID 3104 wrote to memory of 3456 3104 SOA APR 24.exe SOA APR 24.exe PID 3104 wrote to memory of 3456 3104 SOA APR 24.exe SOA APR 24.exe PID 3104 wrote to memory of 3456 3104 SOA APR 24.exe SOA APR 24.exe PID 3104 wrote to memory of 3456 3104 SOA APR 24.exe SOA APR 24.exe PID 3104 wrote to memory of 3456 3104 SOA APR 24.exe SOA APR 24.exe PID 3104 wrote to memory of 3456 3104 SOA APR 24.exe SOA APR 24.exe PID 3104 wrote to memory of 3456 3104 SOA APR 24.exe SOA APR 24.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SOA APR 24.exe"C:\Users\Admin\AppData\Local\Temp\SOA APR 24.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SOA APR 24.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3492
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eeOuEr.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:944
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eeOuEr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp76B6.tmp"2⤵
- Creates scheduled task(s)
PID:1120
-
-
C:\Users\Admin\AppData\Local\Temp\SOA APR 24.exe"C:\Users\Admin\AppData\Local\Temp\SOA APR 24.exe"2⤵PID:2892
-
-
C:\Users\Admin\AppData\Local\Temp\SOA APR 24.exe"C:\Users\Admin\AppData\Local\Temp\SOA APR 24.exe"2⤵PID:2852
-
-
C:\Users\Admin\AppData\Local\Temp\SOA APR 24.exe"C:\Users\Admin\AppData\Local\Temp\SOA APR 24.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3456
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD50d45526c50bd722d85ddb63f675d3e90
SHA1753df2be671aa67b2073fbf74cf5f65e4867869b
SHA256a7dfd0ba1918bd5b2d1faca29bc8955794083b4d7883128567bdd647e12141f4
SHA512552ac2b15eb5c79f81306a3c8d7b1c492c45c1b192f625ea59d751f688c5451c001f9f992d90c9e4c90215f9ca746c15672d1a62a3dbb5de1064962d426b9b1d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD52e2c9a2ea078f8cf53f2441f0cc7b8c4
SHA1eb4c58e83740abba500fdf03b5b51a48d2286e66
SHA256ecf9c114ffb7055021e4984f2fcbf646cfe859937fa2f846818c9ae11940022a
SHA512fd99479340ac07f72dc1a2605ad2d2ef4b1d71822adaec829a2d1ef3e82a7e200cf5af02ea774bf2a2b7f67469d57eb2958bb516c3b689dcc288d46ebd4021b4