Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 01:55
Static task
static1
Behavioral task
behavioral1
Sample
2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe
Resource
win7-20240508-en
General
-
Target
2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe
-
Size
751KB
-
MD5
e6b7493437b908e9d81f7aa0c477fa60
-
SHA1
3cf0249d2239a9b73146e505d3a09d350f43ff3d
-
SHA256
2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f
-
SHA512
148696e8bd3da3f7ed504e8ea4c4bef6dade456863451c553eafae0231ee978bc621730c0770f4e3cd25a3716e36938c80a31fa8d5a12eb318ab20f8e062f44d
-
SSDEEP
12288:8qxcZsfQrHrrQWoqbINii6MvPNaQSzBfBAl0YBMpACR5leZlNm:iZUQjALqbIsi6MHlSF5e0YKpA+erY
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.albushrametalic.com - Port:
587 - Username:
[email protected] - Password:
GLBL1285# - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exedescription pid process target process PID 2580 set thread context of 2504 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exeMSBuild.exepowershell.exepid process 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe 2504 MSBuild.exe 2504 MSBuild.exe 1384 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exeMSBuild.exepowershell.exedescription pid process Token: SeDebugPrivilege 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe Token: SeDebugPrivilege 2504 MSBuild.exe Token: SeDebugPrivilege 1384 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exedescription pid process target process PID 2580 wrote to memory of 1384 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe powershell.exe PID 2580 wrote to memory of 1384 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe powershell.exe PID 2580 wrote to memory of 1384 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe powershell.exe PID 2580 wrote to memory of 1384 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe powershell.exe PID 2580 wrote to memory of 2704 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe schtasks.exe PID 2580 wrote to memory of 2704 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe schtasks.exe PID 2580 wrote to memory of 2704 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe schtasks.exe PID 2580 wrote to memory of 2704 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe schtasks.exe PID 2580 wrote to memory of 2504 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe MSBuild.exe PID 2580 wrote to memory of 2504 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe MSBuild.exe PID 2580 wrote to memory of 2504 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe MSBuild.exe PID 2580 wrote to memory of 2504 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe MSBuild.exe PID 2580 wrote to memory of 2504 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe MSBuild.exe PID 2580 wrote to memory of 2504 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe MSBuild.exe PID 2580 wrote to memory of 2504 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe MSBuild.exe PID 2580 wrote to memory of 2504 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe MSBuild.exe PID 2580 wrote to memory of 2504 2580 2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe"C:\Users\Admin\AppData\Local\Temp\2ca6ab9b5571aef408c1f47e4a3802834283b97fd2a75c0e6f675d92fe2b322f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KWWsRGkWKXnwqv.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1384 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KWWsRGkWKXnwqv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4B24.tmp"2⤵
- Creates scheduled task(s)
PID:2704 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59ee1583c89114c0c34f528e753306f21
SHA16dd35682ff95916c222488a92e42e8f3431cad7c
SHA2560a79407fb77c7cfca3c11f99b7b2b3035e3dea92f7bc6e9513c6cbe8d58e0953
SHA51287e4404ff8d610a84824f454d49ce63ba1d449c33d9c6e4d2546edf67cb690e6dd07cdae5eda0df2f8ce5de750de0a86b9e0758341bde2bac49d8464566b67ca