Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-09-2024 01:10
Static task
static1
Behavioral task
behavioral1
Sample
3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe
Resource
win10v2004-20240802-en
General
-
Target
3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe
-
Size
1.4MB
-
MD5
7c89b48a2752a771eb6457fe2fea1d8e
-
SHA1
afb602ef798b23f400fd3d474cb570aa781797c4
-
SHA256
3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce
-
SHA512
9338a3817216563677573599d5dd3cacb4be084a2e46c77516d56a207ce7d8d06a376ea4be1a7863ffeb823ae803b891ef947cfb81d4813a52ce152038e97d48
-
SSDEEP
24576:OnpUwegOzvr+8J97vsJRx1osJYWDaK9rB6hjscMmQV5IPiMtWb05UaaYy6nnjqKh:OCri8H7vsjx1V15B6xscMmY6ivQUNEjF
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.iaa-airferight.com - Port:
587 - Username:
[email protected] - Password:
webmaster - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3016 powershell.exe 2240 powershell.exe 2112 powershell.exe 3028 powershell.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org 4 api.ipify.org -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2532 set thread context of 2648 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 2648 set thread context of 3048 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2900 schtasks.exe 2848 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2112 powershell.exe 2240 powershell.exe 3028 powershell.exe 3016 powershell.exe 3048 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 3048 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2112 powershell.exe Token: SeDebugPrivilege 2240 powershell.exe Token: SeDebugPrivilege 3028 powershell.exe Token: SeDebugPrivilege 3016 powershell.exe Token: SeDebugPrivilege 3048 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2240 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 31 PID 2532 wrote to memory of 2240 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 31 PID 2532 wrote to memory of 2240 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 31 PID 2532 wrote to memory of 2240 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 31 PID 2532 wrote to memory of 2112 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 33 PID 2532 wrote to memory of 2112 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 33 PID 2532 wrote to memory of 2112 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 33 PID 2532 wrote to memory of 2112 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 33 PID 2532 wrote to memory of 2900 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 35 PID 2532 wrote to memory of 2900 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 35 PID 2532 wrote to memory of 2900 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 35 PID 2532 wrote to memory of 2900 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 35 PID 2532 wrote to memory of 2648 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 2532 wrote to memory of 2648 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 2532 wrote to memory of 2648 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 2532 wrote to memory of 2648 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 2532 wrote to memory of 2648 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 2532 wrote to memory of 2648 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 2532 wrote to memory of 2648 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 2532 wrote to memory of 2648 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 2532 wrote to memory of 2648 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 2532 wrote to memory of 2648 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 2532 wrote to memory of 2648 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 2532 wrote to memory of 2648 2532 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 37 PID 2648 wrote to memory of 3028 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 38 PID 2648 wrote to memory of 3028 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 38 PID 2648 wrote to memory of 3028 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 38 PID 2648 wrote to memory of 3028 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 38 PID 2648 wrote to memory of 3016 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 40 PID 2648 wrote to memory of 3016 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 40 PID 2648 wrote to memory of 3016 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 40 PID 2648 wrote to memory of 3016 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 40 PID 2648 wrote to memory of 2848 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 41 PID 2648 wrote to memory of 2848 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 41 PID 2648 wrote to memory of 2848 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 41 PID 2648 wrote to memory of 2848 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 41 PID 2648 wrote to memory of 3048 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2648 wrote to memory of 3048 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2648 wrote to memory of 3048 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2648 wrote to memory of 3048 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2648 wrote to memory of 3048 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2648 wrote to memory of 3048 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2648 wrote to memory of 3048 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2648 wrote to memory of 3048 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2648 wrote to memory of 3048 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2648 wrote to memory of 3048 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2648 wrote to memory of 3048 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44 PID 2648 wrote to memory of 3048 2648 3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe"C:\Users\Admin\AppData\Local\Temp\3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IbwIIBmUDWimTZ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IbwIIBmUDWimTZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp242.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2900
-
-
C:\Users\Admin\AppData\Local\Temp\3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe"C:\Users\Admin\AppData\Local\Temp\3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3028
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wlBldyvi.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wlBldyvi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3459.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2848
-
-
C:\Users\Admin\AppData\Local\Temp\3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe"C:\Users\Admin\AppData\Local\Temp\3d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51a937cb717834f2ffe17e297282b79d9
SHA1bcfc981e7e99e833f2c46c25347e1a0eeeefd88a
SHA256fe5b002b0028e38e8c853e8e6d8e9436e3858f77187ccc50bb67b5d0ac546ec1
SHA512b1fa898407c1fba954df18fe6f45d3a404720a092c6a5cc1220c67d2e26d63cce73f5354cb7129229f39c7dc758b2ae583c6d6ee10b8085739b80726a712de9d
-
Filesize
1KB
MD5592d3f1d9c10d406b5b39b7f9024baa6
SHA1f7c3a5e36aa55329144b05107f6c2f2183cb2678
SHA256ab86a22df7dc190ff70a7b9ab15707e029b4fa926b6273ccd1e4f042fbaadfd0
SHA512c3822b8348b9b1c26ba375bfbcf703ec4967ebf9fbb4823d27b39061f12df59585fc474ac25e9638fa28b720f0af028fd889659d7482dfe46cba8bca63c9480d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5e3c3ec7405c52d78d390cc8f2d6e75fb
SHA12d55ccd41de359d6db49e4ddcc7c15d164d7ad46
SHA25659460665eaacd935c278bb6093e390d9eba7b6f497d9007af794468cbb5bed87
SHA512ecaf9600a3b60d00f22eb5601869125f4d1488ed6dc5bd8c94cd839be52f93e054003564cc3830580aa915473d13db704e46b619a72da07bdaac2579cc27adcc
-
Filesize
1.4MB
MD57c89b48a2752a771eb6457fe2fea1d8e
SHA1afb602ef798b23f400fd3d474cb570aa781797c4
SHA2563d1e16dec7f88b3ccdf7197c64a6eea6a7d3599c12f34893d60012ffd61f15ce
SHA5129338a3817216563677573599d5dd3cacb4be084a2e46c77516d56a207ce7d8d06a376ea4be1a7863ffeb823ae803b891ef947cfb81d4813a52ce152038e97d48