Analysis
-
max time kernel
139s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 01:14
Static task
static1
Behavioral task
behavioral1
Sample
d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exe
Resource
win10v2004-20240709-en
General
-
Target
d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exe
-
Size
1.1MB
-
MD5
fe9e13e6699fea31c8924575f766fdab
-
SHA1
7f8f162c4edfe354e1e8c364e7fce9822a4b163c
-
SHA256
d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f
-
SHA512
b0df79cbedcba128b257afbc422217176bf6fb2555b65f931bdbd93421d10afceb856b564431f397e8eb23047cf1031e2d9b68f7188c0942738c095ede3b8ea6
-
SSDEEP
24576:0qDEvCTbMWu7rQYlBQcBiT6rprG8avKumalX8f:0TvC/MTQYxsWR7avsgX8
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.antoniomayol.com:21 - Port:
21 - Username:
[email protected] - Password:
cMhKDQUk1{;%
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Drops startup file 1 IoCs
Processes:
intemerateness.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\intemerateness.vbs intemerateness.exe -
Executes dropped EXE 1 IoCs
Processes:
intemerateness.exepid process 2796 intemerateness.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 22 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\nasal\intemerateness.exe autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
intemerateness.exedescription pid process target process PID 2796 set thread context of 3892 2796 intemerateness.exe RegSvcs.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2772 2796 WerFault.exe intemerateness.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exeintemerateness.exeRegSvcs.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intemerateness.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 3892 RegSvcs.exe 3892 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
intemerateness.exepid process 2796 intemerateness.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 3892 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exeintemerateness.exepid process 856 d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exe 856 d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exe 2796 intemerateness.exe 2796 intemerateness.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exeintemerateness.exepid process 856 d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exe 856 d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exe 2796 intemerateness.exe 2796 intemerateness.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exeintemerateness.exedescription pid process target process PID 856 wrote to memory of 2796 856 d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exe intemerateness.exe PID 856 wrote to memory of 2796 856 d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exe intemerateness.exe PID 856 wrote to memory of 2796 856 d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exe intemerateness.exe PID 2796 wrote to memory of 3892 2796 intemerateness.exe RegSvcs.exe PID 2796 wrote to memory of 3892 2796 intemerateness.exe RegSvcs.exe PID 2796 wrote to memory of 3892 2796 intemerateness.exe RegSvcs.exe PID 2796 wrote to memory of 3892 2796 intemerateness.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exe"C:\Users\Admin\AppData\Local\Temp\d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\nasal\intemerateness.exe"C:\Users\Admin\AppData\Local\Temp\d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 6923⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2796 -ip 27961⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\murkyFilesize
28KB
MD5b7a1b7f7c29e5bbfcba86553250654c8
SHA17bd88b124fb15a9098e620ecbcbd2953484429a8
SHA256ed7361d65744a0b7c05049a1a42ab6245fa84e5c641fa9b70a369a1ed881e40c
SHA5127a424d690476047d3ac90914a04cf84d598522834cc4534cc6eeff4f4a6567ec5667d00c8327b079fe96708a5fdab14807dd4da3fc158dd3629becadc41ed822
-
C:\Users\Admin\AppData\Local\Temp\surmountFilesize
239KB
MD58b17c63bd76e03e75bd7bccb1c9ca4f5
SHA160e0165c7ba708cc53daac3f7bbf822e4d667bd4
SHA2569ec913a11b1ab99a5614d81788bfd85e811ca2eb1a6222de226ef8d1118c4ec9
SHA512cfa6c757871798fee5a30c2c759496348f52e31d9059d107cb7db99ca3491ca80e2cbe79ffd9ff33781d4343a910bcf74137a64f031e10cd50b4419de530b951
-
C:\Users\Admin\AppData\Local\nasal\intemerateness.exeFilesize
1.1MB
MD5fe9e13e6699fea31c8924575f766fdab
SHA17f8f162c4edfe354e1e8c364e7fce9822a4b163c
SHA256d24f68e1cf853bb1e1a72b8b4cdbe8443cad9ba3e04229e1e7f103c69789e98f
SHA512b0df79cbedcba128b257afbc422217176bf6fb2555b65f931bdbd93421d10afceb856b564431f397e8eb23047cf1031e2d9b68f7188c0942738c095ede3b8ea6
-
memory/856-11-0x0000000000BF0000-0x0000000000BF4000-memory.dmpFilesize
16KB
-
memory/3892-32-0x0000000005F60000-0x0000000006504000-memory.dmpFilesize
5.6MB
-
memory/3892-31-0x000000007416E000-0x000000007416F000-memory.dmpFilesize
4KB
-
memory/3892-30-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/3892-33-0x0000000005A20000-0x0000000005A86000-memory.dmpFilesize
408KB
-
memory/3892-34-0x0000000074160000-0x0000000074910000-memory.dmpFilesize
7.7MB
-
memory/3892-35-0x0000000006D10000-0x0000000006D60000-memory.dmpFilesize
320KB
-
memory/3892-36-0x0000000006E00000-0x0000000006E92000-memory.dmpFilesize
584KB
-
memory/3892-37-0x0000000006D90000-0x0000000006D9A000-memory.dmpFilesize
40KB
-
memory/3892-38-0x000000007416E000-0x000000007416F000-memory.dmpFilesize
4KB
-
memory/3892-39-0x0000000074160000-0x0000000074910000-memory.dmpFilesize
7.7MB