Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2024 18:23
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Ödeme Onay Kopyası.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
Ödeme Onay Kopyası.exe
-
Size
1.0MB
-
MD5
102f24e21c6ebef365ac013322df92be
-
SHA1
1f2ae631345ea1b6ca6570eb3bf3300e40a3d1d9
-
SHA256
fa55c7177a87dfc91f227846c8e52fd5f7a073a32e818b5c7f9680784f7c15e2
-
SHA512
d9573a1c4d7ca08b5775003284febe2830ce744a4e10d1ca1ec5d350c4b12334a2803fa1bf6adcb6007b4eea176b59df7b932d537bceed347b6e470bdc6b69cd
-
SSDEEP
24576:cAHnh+eWsN3skA4RV1Hom2KXMmHarjvnaIRvf8dP5:7h+ZkldoPK8Yarjvbm
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: ftp- Host:
ftp://backup.smartape.ru - Port:
21 - Username:
user894492 - Password:
w6NZOdcSkH1a
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4600 set thread context of 4352 4600 Ödeme Onay Kopyası.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ödeme Onay Kopyası.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4352 RegSvcs.exe 4352 RegSvcs.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4916 taskmgr.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4600 Ödeme Onay Kopyası.exe 4600 Ödeme Onay Kopyası.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4352 RegSvcs.exe Token: SeDebugPrivilege 4916 taskmgr.exe Token: SeSystemProfilePrivilege 4916 taskmgr.exe Token: SeCreateGlobalPrivilege 4916 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4600 Ödeme Onay Kopyası.exe 4600 Ödeme Onay Kopyası.exe 4600 Ödeme Onay Kopyası.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4600 Ödeme Onay Kopyası.exe 4600 Ödeme Onay Kopyası.exe 4600 Ödeme Onay Kopyası.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe 4916 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4600 wrote to memory of 4352 4600 Ödeme Onay Kopyası.exe 87 PID 4600 wrote to memory of 4352 4600 Ödeme Onay Kopyası.exe 87 PID 4600 wrote to memory of 4352 4600 Ödeme Onay Kopyası.exe 87 PID 4600 wrote to memory of 4352 4600 Ödeme Onay Kopyası.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ödeme Onay Kopyası.exe"C:\Users\Admin\AppData\Local\Temp\Ödeme Onay Kopyası.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Ödeme Onay Kopyası.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4352
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4916
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.2MB
MD5f6d8913637f1d5d2dc846de70ce02dc5
SHA15fc9c6ab334db1f875fbc59a03f5506c478c6c3e
SHA2564e72ca1baee2c7c0f50a42614d101159a9c653a8d6f7498f7bf9d7026c24c187
SHA51221217a0a0eca58fc6058101aa69cf30d5dbe419c21fa7a160f44d8ebbcf5f4011203542c8f400a9bb8ee3826706417f2939c402f605817df597b7ff812b43036