Analysis
-
max time kernel
120s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 09:50
Static task
static1
Behavioral task
behavioral1
Sample
document.exe
Resource
win7-20240221-en
General
-
Target
document.exe
-
Size
679KB
-
MD5
bb277f03c2e761e03643369ef4d9f1da
-
SHA1
8f44aa9566f9da9c7086d6da8f080c7a7de52050
-
SHA256
8054c765c0425811e3632409c6bbd9149fde1de08593796957ca55ead7e9e683
-
SHA512
e5d754214062f9f7767116d9aaa23abf70094a113cd682d257c145ca7e0825d344259149087df4dfee14ead93e61b476c2135522a859d8720d625a5693846cf0
-
SSDEEP
12288:m67FxhThagHCN1x2W6BU8KbYJ6BrBpz86Q5NxdDHEYMxVhmaAkgBzJzmh:pDhThagq1/60bYG1pz8LN+hmacBNzmh
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
phoenixblowers.com - Port:
587 - Username:
[email protected] - Password:
Officeback@2022# - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
document.exedescription pid process target process PID 2896 set thread context of 2716 2896 document.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
document.exeRegSvcs.exepowershell.exepid process 2896 document.exe 2896 document.exe 2716 RegSvcs.exe 2716 RegSvcs.exe 2624 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
document.exeRegSvcs.exepowershell.exedescription pid process Token: SeDebugPrivilege 2896 document.exe Token: SeDebugPrivilege 2716 RegSvcs.exe Token: SeDebugPrivilege 2624 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
document.exedescription pid process target process PID 2896 wrote to memory of 2624 2896 document.exe powershell.exe PID 2896 wrote to memory of 2624 2896 document.exe powershell.exe PID 2896 wrote to memory of 2624 2896 document.exe powershell.exe PID 2896 wrote to memory of 2624 2896 document.exe powershell.exe PID 2896 wrote to memory of 2808 2896 document.exe schtasks.exe PID 2896 wrote to memory of 2808 2896 document.exe schtasks.exe PID 2896 wrote to memory of 2808 2896 document.exe schtasks.exe PID 2896 wrote to memory of 2808 2896 document.exe schtasks.exe PID 2896 wrote to memory of 2716 2896 document.exe RegSvcs.exe PID 2896 wrote to memory of 2716 2896 document.exe RegSvcs.exe PID 2896 wrote to memory of 2716 2896 document.exe RegSvcs.exe PID 2896 wrote to memory of 2716 2896 document.exe RegSvcs.exe PID 2896 wrote to memory of 2716 2896 document.exe RegSvcs.exe PID 2896 wrote to memory of 2716 2896 document.exe RegSvcs.exe PID 2896 wrote to memory of 2716 2896 document.exe RegSvcs.exe PID 2896 wrote to memory of 2716 2896 document.exe RegSvcs.exe PID 2896 wrote to memory of 2716 2896 document.exe RegSvcs.exe PID 2896 wrote to memory of 2716 2896 document.exe RegSvcs.exe PID 2896 wrote to memory of 2716 2896 document.exe RegSvcs.exe PID 2896 wrote to memory of 2716 2896 document.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\document.exe"C:\Users\Admin\AppData\Local\Temp\document.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZAZphYTyWlIUJ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZAZphYTyWlIUJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCE47.tmp"2⤵
- Creates scheduled task(s)
PID:2808 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a1449b958f8e8caf550b9a199077174f
SHA1d9bfe3d33a049363ff22d016fc70e0808cf620fd
SHA256b9005a34258f0478c48a0163c60ececca908970ba124c51d6735576695a5b1fe
SHA5128655c43456246005f625468da240dc3444f903f9904c48ddec525e48ad60b25396ae9c4b0a1b498f3d8be9e189344f58dc38a892176036d01137bd4f087bb28f