Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-09-2024 10:27
Static task
static1
Behavioral task
behavioral1
Sample
Trojan.Win32.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Trojan.Win32.exe
Resource
win10v2004-20240802-en
General
-
Target
Trojan.Win32.exe
-
Size
1.1MB
-
MD5
a4ce1e254f94ddadcdc22828387203b0
-
SHA1
2ec0421afe6315ab24aa9c4219d5ee602798297b
-
SHA256
fae3c02edbdbe902b73f28b56b12f62041fc0fc360c42f970cdff0d91310bb32
-
SHA512
20c044a0332cfda930d43552681602a47b8a27ba977415bf434cb1a85b29a8f7347d9c80d69aa4a72c09a9746f7ab241c7d52add9b513700c8f18b815a3de4a9
-
SSDEEP
24576:s4lavt0LkLL9IMixoEgeahX2aCKPoiPNR5Mq9MmCS:7kwkn9IMHeahX2axtN4aPCS
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp8nl.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
@qwerty90123 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1704 set thread context of 1384 1704 Trojan.Win32.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan.Win32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1384 RegSvcs.exe 1384 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1704 Trojan.Win32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1384 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1704 Trojan.Win32.exe 1704 Trojan.Win32.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1704 Trojan.Win32.exe 1704 Trojan.Win32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1704 wrote to memory of 1384 1704 Trojan.Win32.exe 30 PID 1704 wrote to memory of 1384 1704 Trojan.Win32.exe 30 PID 1704 wrote to memory of 1384 1704 Trojan.Win32.exe 30 PID 1704 wrote to memory of 1384 1704 Trojan.Win32.exe 30 PID 1704 wrote to memory of 1384 1704 Trojan.Win32.exe 30 PID 1704 wrote to memory of 1384 1704 Trojan.Win32.exe 30 PID 1704 wrote to memory of 1384 1704 Trojan.Win32.exe 30 PID 1704 wrote to memory of 1384 1704 Trojan.Win32.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1384
-