Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 08:15
Static task
static1
Behavioral task
behavioral1
Sample
db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe
Resource
win7-20240221-en
General
-
Target
db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe
-
Size
844KB
-
MD5
e4aaca7e0fe69ced3fc467506885a9d9
-
SHA1
dd9554514cba10808aa3e0f32c9f5f22c37e6995
-
SHA256
db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc
-
SHA512
8254f7c3844db4e95f98431a00c7795650b5c9720670aac178b87c2ac444c86e34bc84f53ffd59fda16781aab6fcc86fcf81850f007189ca65db2c61dfbdbbc5
-
SSDEEP
24576:Vw4bjw4bajqV8d707FhxVROXXaeSA+oafS7:Vw4bjw4bajN0xPOCBfk
Malware Config
Extracted
Protocol: smtp- Host:
mail.bethesdakindergarten.com - Port:
587 - Username:
[email protected] - Password:
kindy6014587474
Extracted
agenttesla
Protocol: smtp- Host:
mail.bethesdakindergarten.com - Port:
587 - Username:
[email protected] - Password:
kindy6014587474 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2804 powershell.exe 2504 powershell.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exedescription pid process target process PID 1612 set thread context of 2052 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exedb6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exepowershell.exepowershell.exepid process 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe 2052 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe 2052 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe 2804 powershell.exe 2504 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exedb6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe Token: SeDebugPrivilege 2052 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe Token: SeDebugPrivilege 2804 powershell.exe Token: SeDebugPrivilege 2504 powershell.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exedescription pid process target process PID 1612 wrote to memory of 2804 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe powershell.exe PID 1612 wrote to memory of 2804 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe powershell.exe PID 1612 wrote to memory of 2804 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe powershell.exe PID 1612 wrote to memory of 2804 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe powershell.exe PID 1612 wrote to memory of 2504 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe powershell.exe PID 1612 wrote to memory of 2504 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe powershell.exe PID 1612 wrote to memory of 2504 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe powershell.exe PID 1612 wrote to memory of 2504 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe powershell.exe PID 1612 wrote to memory of 2552 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe schtasks.exe PID 1612 wrote to memory of 2552 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe schtasks.exe PID 1612 wrote to memory of 2552 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe schtasks.exe PID 1612 wrote to memory of 2552 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe schtasks.exe PID 1612 wrote to memory of 2052 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe PID 1612 wrote to memory of 2052 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe PID 1612 wrote to memory of 2052 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe PID 1612 wrote to memory of 2052 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe PID 1612 wrote to memory of 2052 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe PID 1612 wrote to memory of 2052 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe PID 1612 wrote to memory of 2052 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe PID 1612 wrote to memory of 2052 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe PID 1612 wrote to memory of 2052 1612 db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe"C:\Users\Admin\AppData\Local\Temp\db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eRkUBYSG.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eRkUBYSG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA737.tmp"2⤵
- Creates scheduled task(s)
PID:2552
-
-
C:\Users\Admin\AppData\Local\Temp\db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe"C:\Users\Admin\AppData\Local\Temp\db6e594697d85074a16f8ce893649435b356c1ae31724203df7e5463bb97d1fc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5abf2be8c3d761d7c453e97c5489ed56c
SHA1a70fb082edd18ad864373c5b1c997f882f932d8a
SHA25695fc95c8cf4433e3379694eb869c47627411d8c866d19ed7b8ba61c86b7403fe
SHA512423ebadadaca2d88ea45dcf725b2854b3af60afbf58bb180d51ccfd32afc7332367722c04f559472ca882bb3cc551199d29f589ce0085709af70f8a77566e673
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UFDY2L8HU4APBP0KF7NF.temp
Filesize7KB
MD530795f4d83bed941746aea2f01366c4c
SHA1dc824a263d8dc472ae0196e4c3e027f1a7fc9b12
SHA256bf9c9c6b4feb6a5a5f86385751131497e829a3c40eb88b1f7230242f983f0630
SHA512d7d898ba6f6e7f405962fbe61bc341da81991527080db3a3820355bf70cfebddbc47aa3408aa6c87fff56f07181e4402acd3a9ed81821d53c8710998c4a68130