Analysis
-
max time kernel
1801s -
max time network
1592s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
08-09-2024 10:11
General
-
Target
CPSLimiter_cracked.exe
-
Size
43.7MB
-
MD5
1c58c601431a646734a911353b48a14b
-
SHA1
ae30c25247d59812f5d98cd00e064787456ca907
-
SHA256
f54ccc4a398705e3e859ca2350998717ceb82eb956f855b3cec25024a40b0124
-
SHA512
661882ab62a879c1656f5b594f1b0f7e11eeba1b8405ec3220ef393bc9cffc497368535fcd2aec468ff3ce3d9dcc2259e020ae895b6fda8f6732394a5b67493c
-
SSDEEP
786432:ZTDyC6Nr3YRxpmZGxxpxuPGRIiAAbsstsErrG5sWGaakD9kFkrd+XTt8DUjYLT:Z/L0kHYS8PGRPbsWrr4sWriCf
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
resource yara_rule behavioral1/memory/4764-9-0x0000000007DB0000-0x0000000007FA6000-memory.dmp family_agenttesla -
resource yara_rule behavioral1/memory/4764-2-0x00000000008B0000-0x0000000003482000-memory.dmp vmprotect behavioral1/memory/4764-25-0x00000000008B0000-0x0000000003482000-memory.dmp vmprotect -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPSLimiter_cracked.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus CPSLimiter_cracked.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus CPSLimiter_cracked.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus CPSLimiter_cracked.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS CPSLimiter_cracked.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer CPSLimiter_cracked.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion CPSLimiter_cracked.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4468 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4764 CPSLimiter_cracked.exe Token: SeDebugPrivilege 4468 taskmgr.exe Token: SeSystemProfilePrivilege 4468 taskmgr.exe Token: SeCreateGlobalPrivilege 4468 taskmgr.exe Token: 33 1052 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1052 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe 4468 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4764 CPSLimiter_cracked.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CPSLimiter_cracked.exe"C:\Users\Admin\AppData\Local\Temp\CPSLimiter_cracked.exe"1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4764
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4468
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4241⤵
- Suspicious use of AdjustPrivilegeToken
PID:1052