Overview
overview
10Static
static
80d406f17fa...7d.exe
windows7-x64
100d406f17fa...7d.exe
windows10-2004-x64
101396699458...83.elf
debian-12-armhf
118753a0cb6...76.exe
windows7-x64
1018753a0cb6...76.exe
windows10-2004-x64
1030a973e75f...89.xls
windows7-x64
130a973e75f...89.xls
windows10-2004-x64
13214e308dc...fb.exe
windows7-x64
103214e308dc...fb.exe
windows10-2004-x64
10361cd32a75...b5.elf
debian-12-armhf
960be4a7179...3e.elf
debian-9-armhf
96559c81490...6c.exe
windows7-x64
106559c81490...6c.exe
windows10-2004-x64
106845e34952...cc.elf
debian-9-armhf
96fdf5b4b08...0b.elf
debian-12-mipsel
744daca400...ee.exe
windows7-x64
10744daca400...ee.exe
windows10-2004-x64
107dc25c4e1e...91.exe
windows7-x64
107dc25c4e1e...91.exe
windows10-2004-x64
10819e3765d5...4d.elf
ubuntu-24.04-amd64
9835e27dcd5...73.exe
windows7-x64
7835e27dcd5...73.exe
windows10-2004-x64
78ed5281c02...d4.elf
ubuntu-22.04-amd64
8fd73ae7fb...da.exe
windows7-x64
108fd73ae7fb...da.exe
windows10-2004-x64
10add0cec032...26.exe
windows7-x64
10add0cec032...26.exe
windows10-2004-x64
10ae7dfe0fe3...a6.exe
windows7-x64
10ae7dfe0fe3...a6.exe
windows10-2004-x64
10b218376076...26.exe
windows7-x64
10b218376076...26.exe
windows10-2004-x64
10c7305e86e9...38.exe
windows7-x64
8Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 11:31
Behavioral task
behavioral1
Sample
0d406f17fa6d208a7c58e0907883c1a626ea38f4db206621fd241f8d62f8277d.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0d406f17fa6d208a7c58e0907883c1a626ea38f4db206621fd241f8d62f8277d.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
13966994581adf90c88d36fff75eb33c4a79557cf55fd616124a8c77f883e983.elf
Resource
debian12-armhf-20240418-en
Behavioral task
behavioral4
Sample
18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.exe
Resource
win7-20240221-en
Behavioral task
behavioral5
Sample
18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral6
Sample
30a973e75f85a9ee9063fc4b17e5c6704f2e58ebfef7abe3e1d55c16f51b2e89.xls
Resource
win7-20240221-en
Behavioral task
behavioral7
Sample
30a973e75f85a9ee9063fc4b17e5c6704f2e58ebfef7abe3e1d55c16f51b2e89.xls
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe
Resource
win7-20240611-en
Behavioral task
behavioral9
Sample
3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral10
Sample
361cd32a750b89857322f54b665f7f8849407ba09074e6303be0f26a351f39b5.elf
Resource
debian12-armhf-20240418-en
Behavioral task
behavioral11
Sample
60be4a7179ddc4d9f12fba876443b3d782508b26fd3a93f89c4d128396abcb3e.elf
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral12
Sample
6559c8149044fde6c8d7ba12ef151a181a3635d0e5ea673cdbb65aaea3d4156c.exe
Resource
win7-20240611-en
Behavioral task
behavioral13
Sample
6559c8149044fde6c8d7ba12ef151a181a3635d0e5ea673cdbb65aaea3d4156c.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral14
Sample
6845e34952a416113dbc6fbffae8245d708c9bab6dc801c16f34a84744a3b7cc.elf
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral15
Sample
6fdf5b4b08a5894339c26249e190ce627b9585af846573098bed2c050d0ae80b.elf
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral16
Sample
744daca400af1f5721eaa529ec3fe427e4837e17ff4766f6bb39643aa488bfee.exe
Resource
win7-20240221-en
Behavioral task
behavioral17
Sample
744daca400af1f5721eaa529ec3fe427e4837e17ff4766f6bb39643aa488bfee.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral18
Sample
7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe
Resource
win7-20240508-en
Behavioral task
behavioral19
Sample
7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
819e3765d5c40a66951c194f67cdb783e1a711cc3499dd44a43d1cfdec06af4d.elf
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral21
Sample
835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
8ed5281c024dc7cf99273c32faa92e358392272a01898958399e324e666c4fd4.elf
Resource
ubuntu2204-amd64-20240522.1-en
Behavioral task
behavioral24
Sample
8fd73ae7fb9da6bf5d793b56d1cd12a0f2cd342236cca599fb92ecdc1ea700da.exe
Resource
win7-20240508-en
Behavioral task
behavioral25
Sample
8fd73ae7fb9da6bf5d793b56d1cd12a0f2cd342236cca599fb92ecdc1ea700da.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral26
Sample
add0cec032cff1069925f00734c1296bd4e305c4e07006b3b0fa3b9497d8e626.exe
Resource
win7-20240221-en
Behavioral task
behavioral27
Sample
add0cec032cff1069925f00734c1296bd4e305c4e07006b3b0fa3b9497d8e626.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral28
Sample
ae7dfe0fe3ea9ba1dae5221072a51896c9b6c8384eb6514fb9dacbf9d6c7fca6.exe
Resource
win7-20231129-en
Behavioral task
behavioral29
Sample
ae7dfe0fe3ea9ba1dae5221072a51896c9b6c8384eb6514fb9dacbf9d6c7fca6.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral30
Sample
b2183760768b6dffb3c3f4c28510c6e32cae125d46f5d4e046bbdfd860d46b26.exe
Resource
win7-20240611-en
Behavioral task
behavioral31
Sample
b2183760768b6dffb3c3f4c28510c6e32cae125d46f5d4e046bbdfd860d46b26.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral32
Sample
c7305e86e90093f34bae25efd97eb5a8fed3a6b985b1633ee99ffff608211838.exe
Resource
win7-20240611-en
General
-
Target
3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe
-
Size
1.1MB
-
MD5
ec066ae04c36cf907aafa4448b614467
-
SHA1
b53d01c464f61e4654286e8650bb171be14902cf
-
SHA256
3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb
-
SHA512
b30f55db38a1c4297c50d3d7e87748ee7f5d203a002d58a61d5770394bc39a7c1b46b50fa094282eb21330830ea7fa523e3eb5c0ac7f1229ded244c8a3e4529f
-
SSDEEP
24576:gqDEvCTbMWu7rQYlBQcBiT6rprG8ap3H+1PNrT:gTvC/MTQYxsWR7aZe1PNr
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.jaszredony.hu - Port:
587 - Username:
[email protected] - Password:
jRedony77 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops startup file 1 IoCs
Processes:
name.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs name.exe -
Executes dropped EXE 1 IoCs
Processes:
name.exepid process 2124 name.exe -
Loads dropped DLL 1 IoCs
Processes:
3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exepid process 2188 3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\newfile = "C:\\Users\\Admin\\AppData\\Roaming\\newfile\\newfile.exe" RegSvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule \Users\Admin\AppData\Local\directory\name.exe autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
name.exedescription pid process target process PID 2124 set thread context of 2764 2124 name.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 2764 RegSvcs.exe 2764 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
name.exepid process 2124 name.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2764 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exename.exepid process 2188 3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe 2188 3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe 2124 name.exe 2124 name.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exename.exepid process 2188 3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe 2188 3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe 2124 name.exe 2124 name.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exename.exedescription pid process target process PID 2188 wrote to memory of 2124 2188 3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe name.exe PID 2188 wrote to memory of 2124 2188 3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe name.exe PID 2188 wrote to memory of 2124 2188 3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe name.exe PID 2188 wrote to memory of 2124 2188 3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe name.exe PID 2124 wrote to memory of 2764 2124 name.exe RegSvcs.exe PID 2124 wrote to memory of 2764 2124 name.exe RegSvcs.exe PID 2124 wrote to memory of 2764 2124 name.exe RegSvcs.exe PID 2124 wrote to memory of 2764 2124 name.exe RegSvcs.exe PID 2124 wrote to memory of 2764 2124 name.exe RegSvcs.exe PID 2124 wrote to memory of 2764 2124 name.exe RegSvcs.exe PID 2124 wrote to memory of 2764 2124 name.exe RegSvcs.exe PID 2124 wrote to memory of 2764 2124 name.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe"C:\Users\Admin\AppData\Local\Temp\3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\Temp\3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\antiprimerFilesize
239KB
MD5d1f3325ad62eaba5f91f33006ec709cb
SHA1c0f7fa0ebfc408db519423f37fdd46b298cff6c7
SHA256448bd2d99900a089d607f729c5eecf36f60e475929cb12e2262dfd5cf50bac0d
SHA51206f05c8e95b2b3728755417aa2b63c7d9fdfbbdaf0b5f610a10c3ac97419f4941d26b1b9eb1e78da174ba83dec34281c2a9dab6c55e7eab2715fc08df3941930
-
C:\Users\Admin\AppData\Local\Temp\demonetisingFilesize
28KB
MD52893d98764427db040762730399d7d54
SHA1fed5a731656fc6de9f96ed35d108345043fa4fee
SHA2568ac05f366cd7ec1a747987d808de1979e9e7a1eb11dd0a69e47fda8e7bfe5af9
SHA512e4b9454f5aa2af9c7fca01fb467afad76579c7a13952c134547ac4b1f8e563566c62e9417ece91fa4d2758c10a414accade5ed446298374bfa53ee283778e1b6
-
\Users\Admin\AppData\Local\directory\name.exeFilesize
1.1MB
MD5ec066ae04c36cf907aafa4448b614467
SHA1b53d01c464f61e4654286e8650bb171be14902cf
SHA2563214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb
SHA512b30f55db38a1c4297c50d3d7e87748ee7f5d203a002d58a61d5770394bc39a7c1b46b50fa094282eb21330830ea7fa523e3eb5c0ac7f1229ded244c8a3e4529f
-
memory/2188-10-0x0000000000120000-0x0000000000124000-memory.dmpFilesize
16KB
-
memory/2764-30-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2764-33-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2764-34-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2764-35-0x00000000743BE000-0x00000000743BF000-memory.dmpFilesize
4KB
-
memory/2764-36-0x00000000743B0000-0x0000000074A9E000-memory.dmpFilesize
6.9MB
-
memory/2764-38-0x00000000743BE000-0x00000000743BF000-memory.dmpFilesize
4KB
-
memory/2764-39-0x00000000743B0000-0x0000000074A9E000-memory.dmpFilesize
6.9MB