Analysis
-
max time kernel
106s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 16:41
Static task
static1
Behavioral task
behavioral1
Sample
POA1702108.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
POA1702108.exe
Resource
win10v2004-20240802-en
General
-
Target
POA1702108.exe
-
Size
1.3MB
-
MD5
8a0bb862ed0acef45107d21e4735e8e1
-
SHA1
af9661b6eb2ca83be84d013ffcaaf750a38d6afe
-
SHA256
987b95ebff5f1b9e47105ea5c3d5fafc841b1fba94ae40630d956de2654ebdc6
-
SHA512
79a6eb5f61697a36c09d38f4c5ac2da1d4458dcfd13617d28a2d222f3726d38278914421bfb59c2e140ca012ab32727c1d5fc6f3c77ba5341a1b10528de1e3be
-
SSDEEP
24576:uRmJkcoQricOIQxiZY1iaCkt8T6K1lWIWnb2aY48LVbOolTXYO:7JZoQrbTFZY1iaCkeblWIWb2aY48xT1
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nonsubmerged.vbs nonsubmerged.exe -
Executes dropped EXE 3 IoCs
pid Process 1420 nonsubmerged.exe 3384 nonsubmerged.exe 2700 nonsubmerged.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 api.ipify.org 15 api.ipify.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000600000001e4dc-6.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2700 set thread context of 2672 2700 nonsubmerged.exe 90 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language POA1702108.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nonsubmerged.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nonsubmerged.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nonsubmerged.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2672 RegSvcs.exe 2672 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1420 nonsubmerged.exe 3384 nonsubmerged.exe 2700 nonsubmerged.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2672 RegSvcs.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3620 wrote to memory of 1420 3620 POA1702108.exe 83 PID 3620 wrote to memory of 1420 3620 POA1702108.exe 83 PID 3620 wrote to memory of 1420 3620 POA1702108.exe 83 PID 1420 wrote to memory of 2184 1420 nonsubmerged.exe 84 PID 1420 wrote to memory of 2184 1420 nonsubmerged.exe 84 PID 1420 wrote to memory of 2184 1420 nonsubmerged.exe 84 PID 1420 wrote to memory of 3384 1420 nonsubmerged.exe 85 PID 1420 wrote to memory of 3384 1420 nonsubmerged.exe 85 PID 1420 wrote to memory of 3384 1420 nonsubmerged.exe 85 PID 3384 wrote to memory of 908 3384 nonsubmerged.exe 86 PID 3384 wrote to memory of 908 3384 nonsubmerged.exe 86 PID 3384 wrote to memory of 908 3384 nonsubmerged.exe 86 PID 3384 wrote to memory of 2700 3384 nonsubmerged.exe 87 PID 3384 wrote to memory of 2700 3384 nonsubmerged.exe 87 PID 3384 wrote to memory of 2700 3384 nonsubmerged.exe 87 PID 2700 wrote to memory of 2672 2700 nonsubmerged.exe 90 PID 2700 wrote to memory of 2672 2700 nonsubmerged.exe 90 PID 2700 wrote to memory of 2672 2700 nonsubmerged.exe 90 PID 2700 wrote to memory of 2672 2700 nonsubmerged.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\POA1702108.exe"C:\Users\Admin\AppData\Local\Temp\POA1702108.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Hymenophyllaceae\nonsubmerged.exe"C:\Users\Admin\AppData\Local\Temp\POA1702108.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\POA1702108.exe"3⤵PID:2184
-
-
C:\Users\Admin\AppData\Local\Hymenophyllaceae\nonsubmerged.exe"C:\Users\Admin\AppData\Local\Hymenophyllaceae\nonsubmerged.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Hymenophyllaceae\nonsubmerged.exe"4⤵PID:908
-
-
C:\Users\Admin\AppData\Local\Hymenophyllaceae\nonsubmerged.exe"C:\Users\Admin\AppData\Local\Hymenophyllaceae\nonsubmerged.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Hymenophyllaceae\nonsubmerged.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD58a0bb862ed0acef45107d21e4735e8e1
SHA1af9661b6eb2ca83be84d013ffcaaf750a38d6afe
SHA256987b95ebff5f1b9e47105ea5c3d5fafc841b1fba94ae40630d956de2654ebdc6
SHA51279a6eb5f61697a36c09d38f4c5ac2da1d4458dcfd13617d28a2d222f3726d38278914421bfb59c2e140ca012ab32727c1d5fc6f3c77ba5341a1b10528de1e3be