Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

f154ccb1d9...4b.exe

windows7-x64

10

f154ccb1d9...4b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    26/06/2024, 01:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f154ccb1d9e7b8fe43b53c055b89ba3bb6b4626ba307c56225287a4e8495754b.exe

  • Size

    708KB

  • MD5

    e0026df83e1aa08616a11d9104faad46

  • SHA1

    1740312c7651b432fa0ab47819919ec034f8c67b

  • SHA256

    f154ccb1d9e7b8fe43b53c055b89ba3bb6b4626ba307c56225287a4e8495754b

  • SHA512

    6564396ef6b396ae3ee367e6285924d04b4ee2171af4c58c195a61a1a2093adee4baea01e36e58a616fd70257119945666d95f3a943c0e057f1ec66fb64eeb29

  • SSDEEP

    12288:mYV6MorX7qzuC3QHO9FQVHPF51jgcq556I95wyWr5vkTj5+u4Q3lfT1VP9v:lBXu9HGaVHpm5fWrBkToEV71v

Score
10/10
agentteslakeyloggerspywarestealertrojanupx

Malware Config

Extracted

Family

agenttesla

C2

https://discord.com/api/webhooks/1251110202149699625/eDNZWTFoHBDo8HXw0aunmvGeBWciM4C8KyCpUHy9gEFPn1XyMs30gAsSjfRX6u9Vnuig

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Detect packed .NET executables. Mostly AgentTeslaV4. 32 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 32 IoCs
  • Detects executables Discord URL observed in first stage droppers 32 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 32 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 32 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 32 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 32 IoCs
  • UPX dump on OEP (original entry point) 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f154ccb1d9e7b8fe43b53c055b89ba3bb6b4626ba307c56225287a4e8495754b.exe
    "C:\Users\Admin\AppData\Local\Temp\f154ccb1d9e7b8fe43b53c055b89ba3bb6b4626ba307c56225287a4e8495754b.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\f154ccb1d9e7b8fe43b53c055b89ba3bb6b4626ba307c56225287a4e8495754b.exe"
      2⤵
        PID:2164
      • C:\Users\Admin\AppData\Local\Temp\f154ccb1d9e7b8fe43b53c055b89ba3bb6b4626ba307c56225287a4e8495754b.exe
        "C:\Users\Admin\AppData\Local\Temp\f154ccb1d9e7b8fe43b53c055b89ba3bb6b4626ba307c56225287a4e8495754b.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2748
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Users\Admin\AppData\Local\Temp\f154ccb1d9e7b8fe43b53c055b89ba3bb6b4626ba307c56225287a4e8495754b.exe"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2736

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Tar3BDF.tmp
      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

      Download Submit

    • memory/1736-0-0x0000000000380000-0x000000000050F000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/1736-11-0x00000000001A0000-0x00000000001A4000-memory.dmp

      Filesize

      16KB

      Download

    • memory/1736-13-0x0000000000380000-0x000000000050F000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/2736-80-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-68-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-33-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2736-34-0x0000000002260000-0x00000000022B8000-memory.dmp

      Filesize

      352KB

      Download

    • memory/2736-35-0x0000000074B10000-0x00000000751FE000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2736-36-0x0000000002340000-0x0000000002396000-memory.dmp

      Filesize

      344KB

      Download

    • memory/2736-37-0x0000000074B10000-0x00000000751FE000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2736-38-0x0000000074B10000-0x00000000751FE000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2736-54-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-70-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-96-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-94-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-92-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-90-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-88-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-86-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-84-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-82-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-29-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download

    • memory/2736-78-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-76-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-74-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-72-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-30-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download

    • memory/2736-66-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-64-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-62-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-60-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-58-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-56-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-52-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-50-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-48-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-46-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-44-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-42-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-40-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-39-0x0000000002340000-0x0000000002391000-memory.dmp

      Filesize

      324KB

      Download

    • memory/2736-27-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download

    • memory/2736-1181-0x0000000074B10000-0x00000000751FE000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2736-1219-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download

    • memory/2736-1220-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2736-1221-0x0000000074B10000-0x00000000751FE000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2748-14-0x0000000000380000-0x000000000050F000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/2748-32-0x0000000000380000-0x000000000050F000-memory.dmp

      Filesize

      1.6MB

      Download