Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 01:39
Static task
static1
Behavioral task
behavioral1
Sample
8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe
Resource
win10v2004-20240508-en
General
-
Target
8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe
-
Size
1019KB
-
MD5
a87472828e1822c69d04fb6fa679cce5
-
SHA1
2e07c02af7599bfb272cb40b6729cc40d34e5066
-
SHA256
8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63
-
SHA512
871c662769708eb2259379c9af91384a04ee050404c3c6e182e3de8ad4faeed39a005841885c25910a2a2c0772d190be77ab4ac26a87d847814f525db1f5b6c7
-
SSDEEP
24576:NAHnh+eWsN3skA4RV1Hom2KXMmHaCcAEFzkbQnNIgn5:sh+ZkldoPK8YaCrEZ65I
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.gizemetiket.com.tr - Port:
21 - Username:
pgizemM6 - Password:
giz95Ffg
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1752-11-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1752-13-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1752-20-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1752-17-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1752-11-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1752-13-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1752-20-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1752-17-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables referencing Windows vault credential objects. Observed in infostealers 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1752-11-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1752-13-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1752-20-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1752-17-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1752-11-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1752-13-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1752-20-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1752-17-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1752-11-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1752-13-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1752-20-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1752-17-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1752-11-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1752-13-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1752-20-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1752-17-0x0000000000090000-0x00000000000D0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.ipify.org 2 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exedescription pid Process procid_target PID 1920 set thread context of 1752 1920 8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe 28 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid Process 1752 RegSvcs.exe 1752 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exepid Process 1920 8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe 1920 8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid Process Token: SeDebugPrivilege 1752 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exepid Process 1920 8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe 1920 8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exepid Process 1920 8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe 1920 8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid Process 1752 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exedescription pid Process procid_target PID 1920 wrote to memory of 1752 1920 8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe 28 PID 1920 wrote to memory of 1752 1920 8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe 28 PID 1920 wrote to memory of 1752 1920 8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe 28 PID 1920 wrote to memory of 1752 1920 8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe 28 PID 1920 wrote to memory of 1752 1920 8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe 28 PID 1920 wrote to memory of 1752 1920 8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe 28 PID 1920 wrote to memory of 1752 1920 8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe 28 PID 1920 wrote to memory of 1752 1920 8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe"C:\Users\Admin\AppData\Local\Temp\8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\8ce818c607ea14dfa89c7a1ffacb4d2ecec45ddc34da65cd1298ad522f317e63.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1752
-