Analysis
-
max time kernel
146s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 01:06
Static task
static1
Behavioral task
behavioral1
Sample
5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe
Resource
win10v2004-20240426-en
General
-
Target
5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe
-
Size
553KB
-
MD5
1c4a8ce3141c818a47cc7884a1e628f5
-
SHA1
5ce55e99104e28d85b3673010efadc57f011db0b
-
SHA256
5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536
-
SHA512
959929a696078657bed97f4aaf25de9e7e07a9da86bf1c1ad9f3fb207772e2ec052e3f44a365c097820b1b5aafd71f67e8f9d628e6a2f7ca6d42d4a2ab24183e
-
SSDEEP
12288:6qiSdb7nBOvasD05Inm8zMc//bbtI+TAmAIxMH6WKz:3fPB77Onm8zMc/jCTH6vz
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.sunlacn.com - Port:
587 - Username:
[email protected] - Password:
#_57J#lnfgQs
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4628-47-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral2/memory/2880-8-0x00000000055F0000-0x00000000055FC000-memory.dmp CustAttr -
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepid Process 4536 powershell.exe 3268 powershell.exe 4312 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\newapp = "C:\\Users\\Admin\\AppData\\Roaming\\newapp\\newapp.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exedescription pid Process procid_target PID 2880 set thread context of 4628 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 95 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exepowershell.exe5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exeRegSvcs.exepowershell.exepid Process 3268 powershell.exe 4536 powershell.exe 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 4628 RegSvcs.exe 4628 RegSvcs.exe 4312 powershell.exe 3268 powershell.exe 4536 powershell.exe 4312 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exepowershell.exe5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exeRegSvcs.exepowershell.exedescription pid Process Token: SeDebugPrivilege 3268 powershell.exe Token: SeDebugPrivilege 4536 powershell.exe Token: SeDebugPrivilege 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe Token: SeDebugPrivilege 4628 RegSvcs.exe Token: SeDebugPrivilege 4312 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exedescription pid Process procid_target PID 2880 wrote to memory of 4536 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 88 PID 2880 wrote to memory of 4536 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 88 PID 2880 wrote to memory of 4536 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 88 PID 2880 wrote to memory of 3268 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 90 PID 2880 wrote to memory of 3268 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 90 PID 2880 wrote to memory of 3268 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 90 PID 2880 wrote to memory of 880 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 92 PID 2880 wrote to memory of 880 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 92 PID 2880 wrote to memory of 880 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 92 PID 2880 wrote to memory of 4312 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 94 PID 2880 wrote to memory of 4312 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 94 PID 2880 wrote to memory of 4312 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 94 PID 2880 wrote to memory of 4628 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 95 PID 2880 wrote to memory of 4628 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 95 PID 2880 wrote to memory of 4628 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 95 PID 2880 wrote to memory of 4628 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 95 PID 2880 wrote to memory of 4628 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 95 PID 2880 wrote to memory of 4628 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 95 PID 2880 wrote to memory of 4628 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 95 PID 2880 wrote to memory of 4628 2880 5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe"C:\Users\Admin\AppData\Local\Temp\5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5186efdfdceb4fa893f40ac77d48ea439cf222d52637b6e8387053906234d536.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OCFgeyqT.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3268
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OCFgeyqT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC06D.tmp"2⤵
- Creates scheduled task(s)
PID:880
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OCFgeyqT.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4312
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD5bc7a1f47784919d0d37da52774525cdc
SHA155d209c53910e40d0576c98f72af5a0178cbc7ca
SHA25682764e8b67669a72bd52be3435f1f108e145cc5216ce0f9cf75adbe2d6628fc4
SHA51239b1c3c8a0f773a30908558d26f19331a0697466d99a9842a8fde439f914f665a7853f5390a895a992456d532297e7e5a5b78aadf11a3f4923728bb5e7b48fc2
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD51b42b999916537a278495d9f264e3cda
SHA17407d9a4726a7af2a9f47cf8b17929e24b1a2fe6
SHA256e169a5baee7a2015f739b60413f32685c9d0c67a67273ef6eb8f66859a44694e
SHA5120f51228f90828f5891baee8080bad9de726461d12712f015e7b47434a897d3eb25523337009b4cf104e2bd73e313b11f066ee874aba0c2a4a8c47b5a160e0b92