Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:11
Static task
static1
Behavioral task
behavioral1
Sample
c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe
Resource
win7-20240419-en
General
-
Target
c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe
-
Size
710KB
-
MD5
bce028ac3db2ab67415ca231625e2da5
-
SHA1
c45fc5eaa7134e3a16b0c11c9fbb56eebc826ee5
-
SHA256
c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2
-
SHA512
3e962201caa4a48fb3d92e28389ec5301fb4bf2096e3ac05aedb9988ffbf8dd96a43205a3469f9833e0d27bce23473ff403fc903103e94217647e847eeba92a7
-
SSDEEP
12288:hsTeH81jJUkGOsSeErkbwzyroXuk9/P/KtGjEdmKn/XmTv88zJQja2b0dz:t8MkiREQbwzyroD93/KtGje3yFQDb
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot7144649272:AAE81yaV0hNm9NYjCSxHktz9UKMBC1DjAfY/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2692 powershell.exe 2852 powershell.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exedescription pid process target process PID 2084 set thread context of 2512 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exec57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exepowershell.exepowershell.exepid process 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe 2512 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe 2512 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe 2852 powershell.exe 2692 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exec57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe Token: SeDebugPrivilege 2512 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe Token: SeDebugPrivilege 2852 powershell.exe Token: SeDebugPrivilege 2692 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exepid process 2512 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exedescription pid process target process PID 2084 wrote to memory of 2692 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe powershell.exe PID 2084 wrote to memory of 2692 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe powershell.exe PID 2084 wrote to memory of 2692 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe powershell.exe PID 2084 wrote to memory of 2692 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe powershell.exe PID 2084 wrote to memory of 2852 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe powershell.exe PID 2084 wrote to memory of 2852 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe powershell.exe PID 2084 wrote to memory of 2852 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe powershell.exe PID 2084 wrote to memory of 2852 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe powershell.exe PID 2084 wrote to memory of 2752 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe schtasks.exe PID 2084 wrote to memory of 2752 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe schtasks.exe PID 2084 wrote to memory of 2752 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe schtasks.exe PID 2084 wrote to memory of 2752 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe schtasks.exe PID 2084 wrote to memory of 2512 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe PID 2084 wrote to memory of 2512 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe PID 2084 wrote to memory of 2512 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe PID 2084 wrote to memory of 2512 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe PID 2084 wrote to memory of 2512 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe PID 2084 wrote to memory of 2512 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe PID 2084 wrote to memory of 2512 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe PID 2084 wrote to memory of 2512 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe PID 2084 wrote to memory of 2512 2084 c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe"C:\Users\Admin\AppData\Local\Temp\c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WVWcFZn.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WVWcFZn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3B1D.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe"C:\Users\Admin\AppData\Local\Temp\c57fade813309420b189b369e7cc32933d526d4a7ee02581b198c74549bbc3b2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3B1D.tmpFilesize
1KB
MD5fb54910492bc0b4d9f8f9bf5acab8b9c
SHA1b20ef9f9a2e4cfe360fb2fbebc8866854de29899
SHA256748c6420cc888128cfd23ec560b1ea7adc772e12840dece172caf6f87e4fdd50
SHA51295a9fa5036f776ed36fe686531ce764d514c59d9ae7ed80c3ca696958b78ffa90a9e084c54b36e4e50bb4a213d17d3f0899e11731a7773aaf1b483ca432dd379
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\13KR7UC2ZG8IPDBQROV1.tempFilesize
7KB
MD56be01cb2a2eca1e25de9fba8f79adbca
SHA1f1b83eafc34aac9cd175e6e3be72581c1a07ac83
SHA2569d0c009b19a21082ec2406b4368967cce44c12a80a049e9ef60e22c77bae13dc
SHA512a26778b53baec9ee6b1f4228bce396fb7ac04bf2da4696e6b5ece893856acd5b1efd64db80f283c4973b120af7bbb697d0e8469648f51dd3094dc285de5b9b99
-
memory/2084-4-0x00000000003F0000-0x0000000000400000-memory.dmpFilesize
64KB
-
memory/2084-31-0x0000000074930000-0x000000007501E000-memory.dmpFilesize
6.9MB
-
memory/2084-0-0x000000007493E000-0x000000007493F000-memory.dmpFilesize
4KB
-
memory/2084-5-0x0000000000440000-0x0000000000456000-memory.dmpFilesize
88KB
-
memory/2084-6-0x0000000005370000-0x00000000053F4000-memory.dmpFilesize
528KB
-
memory/2084-2-0x0000000074930000-0x000000007501E000-memory.dmpFilesize
6.9MB
-
memory/2084-1-0x00000000012E0000-0x0000000001398000-memory.dmpFilesize
736KB
-
memory/2084-3-0x0000000000390000-0x00000000003B0000-memory.dmpFilesize
128KB
-
memory/2512-19-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2512-29-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2512-28-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2512-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2512-25-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2512-23-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2512-21-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2512-30-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB