Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 14:38
Static task
static1
Behavioral task
behavioral1
Sample
164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe
Resource
win10v2004-20240426-en
General
-
Target
164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe
-
Size
1.2MB
-
MD5
38b40ed92252dde605b71b5b7c2d20a0
-
SHA1
fa584ece47b918be06cb023b98d29711fb4f7c56
-
SHA256
164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18
-
SHA512
9a3615eff6a44626ef9e5301e2719935519a8dbc45c773c9eeb2b71cfc047c61bc8a34ff2225a9bb646bf8489b5e98ecad00878846a1ccb3b07a802e4e44be5f
-
SSDEEP
24576:C+LAcHzC+wPmDvH4RPBPD1cjXc9IIEbCv3zH6s5K4Z3LB0Wve3agJToFtmZCQ/nL:XGcyEb4mM3LykgJkFYZCm5
Malware Config
Extracted
Protocol: smtp- Host:
mail.visiontrade.ae - Port:
587 - Username:
[email protected] - Password:
,,.Ishaq2021 ,,
Extracted
agenttesla
Protocol: smtp- Host:
mail.visiontrade.ae - Port:
587 - Username:
[email protected] - Password:
,,.Ishaq2021 ,, - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exedescription pid process target process PID 1948 set thread context of 3012 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe installutil.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
installutil.exepid process 3012 installutil.exe 3012 installutil.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
installutil.exedescription pid process Token: SeDebugPrivilege 3012 installutil.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
installutil.exepid process 3012 installutil.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exedescription pid process target process PID 1948 wrote to memory of 2628 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe CasPol.exe PID 1948 wrote to memory of 2628 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe CasPol.exe PID 1948 wrote to memory of 2628 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe CasPol.exe PID 1948 wrote to memory of 2628 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe CasPol.exe PID 1948 wrote to memory of 3012 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe installutil.exe PID 1948 wrote to memory of 3012 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe installutil.exe PID 1948 wrote to memory of 3012 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe installutil.exe PID 1948 wrote to memory of 3012 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe installutil.exe PID 1948 wrote to memory of 3012 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe installutil.exe PID 1948 wrote to memory of 3012 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe installutil.exe PID 1948 wrote to memory of 3012 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe installutil.exe PID 1948 wrote to memory of 3012 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe installutil.exe PID 1948 wrote to memory of 3012 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe installutil.exe PID 1948 wrote to memory of 3012 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe installutil.exe PID 1948 wrote to memory of 3012 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe installutil.exe PID 1948 wrote to memory of 3012 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe installutil.exe PID 1948 wrote to memory of 2556 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe WerFault.exe PID 1948 wrote to memory of 2556 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe WerFault.exe PID 1948 wrote to memory of 2556 1948 164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe"C:\Users\Admin\AppData\Local\Temp\164841a083b4f39cef5e2d36ee3a9f4b7c1b915f9e3a9198d1e4e40e5f77fa18.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵PID:2628
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3012 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1948 -s 6322⤵PID:2556
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1948-0-0x000007FEF5BD3000-0x000007FEF5BD4000-memory.dmpFilesize
4KB
-
memory/1948-1-0x0000000000230000-0x000000000023A000-memory.dmpFilesize
40KB
-
memory/1948-2-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmpFilesize
9.9MB
-
memory/1948-3-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmpFilesize
9.9MB
-
memory/1948-4-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmpFilesize
9.9MB
-
memory/1948-5-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmpFilesize
9.9MB
-
memory/1948-6-0x0000000001E20000-0x0000000001EB6000-memory.dmpFilesize
600KB
-
memory/1948-20-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmpFilesize
9.9MB
-
memory/1948-19-0x000007FEF5BD3000-0x000007FEF5BD4000-memory.dmpFilesize
4KB
-
memory/3012-10-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/3012-12-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/3012-9-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/3012-8-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/3012-14-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/3012-16-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/3012-17-0x0000000074AAE000-0x0000000074AAF000-memory.dmpFilesize
4KB
-
memory/3012-18-0x0000000074AA0000-0x000000007518E000-memory.dmpFilesize
6.9MB
-
memory/3012-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3012-7-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/3012-21-0x0000000074AAE000-0x0000000074AAF000-memory.dmpFilesize
4KB
-
memory/3012-22-0x0000000074AA0000-0x000000007518E000-memory.dmpFilesize
6.9MB