Analysis
-
max time kernel
134s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 13:52
Static task
static1
Behavioral task
behavioral1
Sample
Sipariş PO #408232023_ZNG İstanbul_pdf.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Sipariş PO #408232023_ZNG İstanbul_pdf.exe
Resource
win10v2004-20240508-en
General
-
Target
Sipariş PO #408232023_ZNG İstanbul_pdf.exe
-
Size
2.5MB
-
MD5
f55d77a9d704af55b0797de1435706e3
-
SHA1
93010de39c5e434291a439b65f6eb381b741edf3
-
SHA256
5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508
-
SHA512
0ad087c8a2290f890cb58535958566cf6a814415c58f20742d3074d27cd0e4e31f5f3d3a0a4945ec675c84ad99f9894c184ff69fcb702d19443a83729b19bddb
-
SSDEEP
49152:VP6hSrcCPT0J6Lg31+mYGnKDVTXShVr7oL:2ujRmYGnKDVTOr
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
BTwcMq@2 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 17 api.ipify.org 18 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Sipariş PO #408232023_ZNG İstanbul_pdf.exedescription pid process target process PID 4796 set thread context of 1504 4796 Sipariş PO #408232023_ZNG İstanbul_pdf.exe msbuild.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msbuild.exepid process 1504 msbuild.exe 1504 msbuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
msbuild.exedescription pid process Token: SeDebugPrivilege 1504 msbuild.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Sipariş PO #408232023_ZNG İstanbul_pdf.exedescription pid process target process PID 4796 wrote to memory of 1504 4796 Sipariş PO #408232023_ZNG İstanbul_pdf.exe msbuild.exe PID 4796 wrote to memory of 1504 4796 Sipariş PO #408232023_ZNG İstanbul_pdf.exe msbuild.exe PID 4796 wrote to memory of 1504 4796 Sipariş PO #408232023_ZNG İstanbul_pdf.exe msbuild.exe PID 4796 wrote to memory of 1504 4796 Sipariş PO #408232023_ZNG İstanbul_pdf.exe msbuild.exe PID 4796 wrote to memory of 1504 4796 Sipariş PO #408232023_ZNG İstanbul_pdf.exe msbuild.exe PID 4796 wrote to memory of 1504 4796 Sipariş PO #408232023_ZNG İstanbul_pdf.exe msbuild.exe PID 4796 wrote to memory of 1504 4796 Sipariş PO #408232023_ZNG İstanbul_pdf.exe msbuild.exe PID 4796 wrote to memory of 1504 4796 Sipariş PO #408232023_ZNG İstanbul_pdf.exe msbuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sipariş PO #408232023_ZNG İstanbul_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Sipariş PO #408232023_ZNG İstanbul_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1504
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1504-0-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1504-1-0x000000007465E000-0x000000007465F000-memory.dmpFilesize
4KB
-
memory/1504-2-0x0000000005760000-0x0000000005D04000-memory.dmpFilesize
5.6MB
-
memory/1504-3-0x0000000005320000-0x0000000005386000-memory.dmpFilesize
408KB
-
memory/1504-4-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/1504-5-0x0000000006580000-0x00000000065D0000-memory.dmpFilesize
320KB
-
memory/1504-6-0x0000000006670000-0x0000000006702000-memory.dmpFilesize
584KB
-
memory/1504-7-0x00000000065F0000-0x00000000065FA000-memory.dmpFilesize
40KB
-
memory/1504-8-0x000000007465E000-0x000000007465F000-memory.dmpFilesize
4KB
-
memory/1504-9-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB