Analysis
-
max time kernel
133s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 13:12
Static task
static1
Behavioral task
behavioral1
Sample
TÜBİTAK SAGE TEKLİF TALEP VE FİYAT TEKLİFİ sxlx..exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
TÜBİTAK SAGE TEKLİF TALEP VE FİYAT TEKLİFİ sxlx..exe
Resource
win10v2004-20240508-en
General
-
Target
TÜBİTAK SAGE TEKLİF TALEP VE FİYAT TEKLİFİ sxlx..exe
-
Size
2.0MB
-
MD5
456442e5615445a54f15eae38140c50a
-
SHA1
f81074ce9855601a33b97fb357fbee1bbdd7fcf6
-
SHA256
0eca094ac422e8d7b0b58532b5a1fb7a59b4cc6cb6bbe1ec49259ebf10522ae5
-
SHA512
b69f617e0deb48af12f230dcf016211f94eea612f364357d84e96499f61b1bdc028cca43bbfa7f8f169b2645f6f6d6f243671e4c10ab2080f9c5896b45bc8ed0
-
SSDEEP
24576:oynjN3fi9dEoZR814OEQjls30eTFxmT4i8eMOq52jOXuq01dKqOFWYuO:ZjN3CdJ81nEQhs30e1uqsrOFA
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
TÜBİTAK SAGE TEKLİF TALEP VE FİYAT TEKLİFİ sxlx..exedescription pid process target process PID 232 set thread context of 3532 232 TÜBİTAK SAGE TEKLİF TALEP VE FİYAT TEKLİFİ sxlx..exe msbuild.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msbuild.exepid process 3532 msbuild.exe 3532 msbuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
msbuild.exedescription pid process Token: SeDebugPrivilege 3532 msbuild.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
TÜBİTAK SAGE TEKLİF TALEP VE FİYAT TEKLİFİ sxlx..exedescription pid process target process PID 232 wrote to memory of 3532 232 TÜBİTAK SAGE TEKLİF TALEP VE FİYAT TEKLİFİ sxlx..exe msbuild.exe PID 232 wrote to memory of 3532 232 TÜBİTAK SAGE TEKLİF TALEP VE FİYAT TEKLİFİ sxlx..exe msbuild.exe PID 232 wrote to memory of 3532 232 TÜBİTAK SAGE TEKLİF TALEP VE FİYAT TEKLİFİ sxlx..exe msbuild.exe PID 232 wrote to memory of 3532 232 TÜBİTAK SAGE TEKLİF TALEP VE FİYAT TEKLİFİ sxlx..exe msbuild.exe PID 232 wrote to memory of 3532 232 TÜBİTAK SAGE TEKLİF TALEP VE FİYAT TEKLİFİ sxlx..exe msbuild.exe PID 232 wrote to memory of 3532 232 TÜBİTAK SAGE TEKLİF TALEP VE FİYAT TEKLİFİ sxlx..exe msbuild.exe PID 232 wrote to memory of 3532 232 TÜBİTAK SAGE TEKLİF TALEP VE FİYAT TEKLİFİ sxlx..exe msbuild.exe PID 232 wrote to memory of 3532 232 TÜBİTAK SAGE TEKLİF TALEP VE FİYAT TEKLİFİ sxlx..exe msbuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TÜBİTAK SAGE TEKLİF TALEP VE FİYAT TEKLİFİ sxlx..exe"C:\Users\Admin\AppData\Local\Temp\TÜBİTAK SAGE TEKLİF TALEP VE FİYAT TEKLİFİ sxlx..exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3532-1-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3532-2-0x000000007484E000-0x000000007484F000-memory.dmpFilesize
4KB
-
memory/3532-3-0x0000000005CE0000-0x0000000006284000-memory.dmpFilesize
5.6MB
-
memory/3532-4-0x00000000055E0000-0x0000000005646000-memory.dmpFilesize
408KB
-
memory/3532-5-0x0000000074840000-0x0000000074FF0000-memory.dmpFilesize
7.7MB
-
memory/3532-6-0x00000000063E0000-0x0000000006430000-memory.dmpFilesize
320KB
-
memory/3532-7-0x00000000064D0000-0x0000000006562000-memory.dmpFilesize
584KB
-
memory/3532-8-0x0000000006450000-0x000000000645A000-memory.dmpFilesize
40KB
-
memory/3532-9-0x000000007484E000-0x000000007484F000-memory.dmpFilesize
4KB
-
memory/3532-10-0x0000000074840000-0x0000000074FF0000-memory.dmpFilesize
7.7MB