Overview
overview
10Static
static
80d406f17fa...7d.exe
windows7-x64
100d406f17fa...7d.exe
windows10-2004-x64
101396699458...83.elf
debian-12-armhf
118753a0cb6...76.exe
windows7-x64
1018753a0cb6...76.exe
windows10-2004-x64
1030a973e75f...89.xls
windows7-x64
130a973e75f...89.xls
windows10-2004-x64
13214e308dc...fb.exe
windows7-x64
103214e308dc...fb.exe
windows10-2004-x64
10361cd32a75...b5.elf
debian-12-armhf
960be4a7179...3e.elf
debian-9-armhf
96559c81490...6c.exe
windows7-x64
106559c81490...6c.exe
windows10-2004-x64
106845e34952...cc.elf
debian-9-armhf
96fdf5b4b08...0b.elf
debian-12-mipsel
744daca400...ee.exe
windows7-x64
10744daca400...ee.exe
windows10-2004-x64
107dc25c4e1e...91.exe
windows7-x64
107dc25c4e1e...91.exe
windows10-2004-x64
10819e3765d5...4d.elf
ubuntu-24.04-amd64
9835e27dcd5...73.exe
windows7-x64
7835e27dcd5...73.exe
windows10-2004-x64
78ed5281c02...d4.elf
ubuntu-22.04-amd64
8fd73ae7fb...da.exe
windows7-x64
108fd73ae7fb...da.exe
windows10-2004-x64
10add0cec032...26.exe
windows7-x64
10add0cec032...26.exe
windows10-2004-x64
10ae7dfe0fe3...a6.exe
windows7-x64
10ae7dfe0fe3...a6.exe
windows10-2004-x64
10b218376076...26.exe
windows7-x64
10b218376076...26.exe
windows10-2004-x64
10c7305e86e9...38.exe
windows7-x64
8Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 11:31
Behavioral task
behavioral1
Sample
0d406f17fa6d208a7c58e0907883c1a626ea38f4db206621fd241f8d62f8277d.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0d406f17fa6d208a7c58e0907883c1a626ea38f4db206621fd241f8d62f8277d.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
13966994581adf90c88d36fff75eb33c4a79557cf55fd616124a8c77f883e983.elf
Resource
debian12-armhf-20240418-en
Behavioral task
behavioral4
Sample
18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.exe
Resource
win7-20240221-en
Behavioral task
behavioral5
Sample
18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral6
Sample
30a973e75f85a9ee9063fc4b17e5c6704f2e58ebfef7abe3e1d55c16f51b2e89.xls
Resource
win7-20240221-en
Behavioral task
behavioral7
Sample
30a973e75f85a9ee9063fc4b17e5c6704f2e58ebfef7abe3e1d55c16f51b2e89.xls
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe
Resource
win7-20240611-en
Behavioral task
behavioral9
Sample
3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral10
Sample
361cd32a750b89857322f54b665f7f8849407ba09074e6303be0f26a351f39b5.elf
Resource
debian12-armhf-20240418-en
Behavioral task
behavioral11
Sample
60be4a7179ddc4d9f12fba876443b3d782508b26fd3a93f89c4d128396abcb3e.elf
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral12
Sample
6559c8149044fde6c8d7ba12ef151a181a3635d0e5ea673cdbb65aaea3d4156c.exe
Resource
win7-20240611-en
Behavioral task
behavioral13
Sample
6559c8149044fde6c8d7ba12ef151a181a3635d0e5ea673cdbb65aaea3d4156c.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral14
Sample
6845e34952a416113dbc6fbffae8245d708c9bab6dc801c16f34a84744a3b7cc.elf
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral15
Sample
6fdf5b4b08a5894339c26249e190ce627b9585af846573098bed2c050d0ae80b.elf
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral16
Sample
744daca400af1f5721eaa529ec3fe427e4837e17ff4766f6bb39643aa488bfee.exe
Resource
win7-20240221-en
Behavioral task
behavioral17
Sample
744daca400af1f5721eaa529ec3fe427e4837e17ff4766f6bb39643aa488bfee.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral18
Sample
7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe
Resource
win7-20240508-en
Behavioral task
behavioral19
Sample
7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
819e3765d5c40a66951c194f67cdb783e1a711cc3499dd44a43d1cfdec06af4d.elf
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral21
Sample
835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
8ed5281c024dc7cf99273c32faa92e358392272a01898958399e324e666c4fd4.elf
Resource
ubuntu2204-amd64-20240522.1-en
Behavioral task
behavioral24
Sample
8fd73ae7fb9da6bf5d793b56d1cd12a0f2cd342236cca599fb92ecdc1ea700da.exe
Resource
win7-20240508-en
Behavioral task
behavioral25
Sample
8fd73ae7fb9da6bf5d793b56d1cd12a0f2cd342236cca599fb92ecdc1ea700da.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral26
Sample
add0cec032cff1069925f00734c1296bd4e305c4e07006b3b0fa3b9497d8e626.exe
Resource
win7-20240221-en
Behavioral task
behavioral27
Sample
add0cec032cff1069925f00734c1296bd4e305c4e07006b3b0fa3b9497d8e626.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral28
Sample
ae7dfe0fe3ea9ba1dae5221072a51896c9b6c8384eb6514fb9dacbf9d6c7fca6.exe
Resource
win7-20231129-en
Behavioral task
behavioral29
Sample
ae7dfe0fe3ea9ba1dae5221072a51896c9b6c8384eb6514fb9dacbf9d6c7fca6.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral30
Sample
b2183760768b6dffb3c3f4c28510c6e32cae125d46f5d4e046bbdfd860d46b26.exe
Resource
win7-20240611-en
Behavioral task
behavioral31
Sample
b2183760768b6dffb3c3f4c28510c6e32cae125d46f5d4e046bbdfd860d46b26.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral32
Sample
c7305e86e90093f34bae25efd97eb5a8fed3a6b985b1633ee99ffff608211838.exe
Resource
win7-20240611-en
General
-
Target
7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe
-
Size
1.1MB
-
MD5
153458c4d28fe80dbc951898df7348a0
-
SHA1
11bd2534f5e073d7de5560193ad582ebf1fbf19a
-
SHA256
7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791
-
SHA512
7ee79443e9fc623c98b30ab396169eaffb06aa046bc373889cf3de6279a1aea432489c98a764e340c72e27cf782668601807d8541343ae54b8d1bc0241f01318
-
SSDEEP
24576:zAHnh+eWsN3skA4RV1Hom2KXMmHas4Y4uqBp9fcOpbQ5:+h+ZkldoPK8Yas4nuqDDpK
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
^NpBYBQ0 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops startup file 1 IoCs
Processes:
name.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs name.exe -
Executes dropped EXE 1 IoCs
Processes:
name.exepid process 2616 name.exe -
Loads dropped DLL 1 IoCs
Processes:
7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exepid process 2036 7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpTrle = "C:\\Users\\Admin\\AppData\\Roaming\\mpTrle\\mpTrle.exe" RegSvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\directory\name.exe autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
name.exedescription pid process target process PID 2616 set thread context of 2484 2616 name.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 2484 RegSvcs.exe 2484 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
name.exepid process 2616 name.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2484 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exename.exepid process 2036 7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe 2036 7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe 2616 name.exe 2616 name.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exename.exepid process 2036 7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe 2036 7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe 2616 name.exe 2616 name.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exename.exedescription pid process target process PID 2036 wrote to memory of 2616 2036 7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe name.exe PID 2036 wrote to memory of 2616 2036 7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe name.exe PID 2036 wrote to memory of 2616 2036 7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe name.exe PID 2036 wrote to memory of 2616 2036 7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe name.exe PID 2616 wrote to memory of 2484 2616 name.exe RegSvcs.exe PID 2616 wrote to memory of 2484 2616 name.exe RegSvcs.exe PID 2616 wrote to memory of 2484 2616 name.exe RegSvcs.exe PID 2616 wrote to memory of 2484 2616 name.exe RegSvcs.exe PID 2616 wrote to memory of 2484 2616 name.exe RegSvcs.exe PID 2616 wrote to memory of 2484 2616 name.exe RegSvcs.exe PID 2616 wrote to memory of 2484 2616 name.exe RegSvcs.exe PID 2616 wrote to memory of 2484 2616 name.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe"C:\Users\Admin\AppData\Local\Temp\7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\Temp\7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\disimmureMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\directory\name.exeFilesize
1.1MB
MD5153458c4d28fe80dbc951898df7348a0
SHA111bd2534f5e073d7de5560193ad582ebf1fbf19a
SHA2567dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791
SHA5127ee79443e9fc623c98b30ab396169eaffb06aa046bc373889cf3de6279a1aea432489c98a764e340c72e27cf782668601807d8541343ae54b8d1bc0241f01318
-
memory/2036-10-0x0000000000160000-0x0000000000164000-memory.dmpFilesize
16KB
-
memory/2484-30-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2484-32-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2484-34-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2484-35-0x00000000743CE000-0x00000000743CF000-memory.dmpFilesize
4KB
-
memory/2484-36-0x00000000743C0000-0x0000000074AAE000-memory.dmpFilesize
6.9MB
-
memory/2484-38-0x00000000743CE000-0x00000000743CF000-memory.dmpFilesize
4KB
-
memory/2484-39-0x00000000743C0000-0x0000000074AAE000-memory.dmpFilesize
6.9MB