Analysis
-
max time kernel
95s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2024 09:00
Static task
static1
Behavioral task
behavioral1
Sample
RFQ SN00954666 for prosjekt CMC 40 fot container.exe
Resource
win7-20240903-en
General
-
Target
RFQ SN00954666 for prosjekt CMC 40 fot container.exe
-
Size
1.1MB
-
MD5
6f372aad87d442dec0f25eafa57cd9f5
-
SHA1
5cb1f90381f86732a50431e75bf21ee045ddd5a1
-
SHA256
b81164598e70459709bba50dead99248d28e6d4dc0e0e5093fa28ad554c9694a
-
SHA512
627d8b92939349e48803cfcfa50e4efead10761b5444e6a69661fe37ff760f86683be02362e4706d62e7feaba3a093a207183f587b8f0a9d39ac93076be9b24b
-
SSDEEP
24576:ffmMv6Ckr7Mny5QLlYYwMil9A4Zd93j7Vd0044:f3v+7/5QLGYFib93jc07
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
bezelety.top - Port:
587 - Username:
[email protected] - Password:
IxF(..bSed6k - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2392 set thread context of 4124 2392 RFQ SN00954666 for prosjekt CMC 40 fot container.exe 82 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ SN00954666 for prosjekt CMC 40 fot container.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4124 RegSvcs.exe 4124 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2392 RFQ SN00954666 for prosjekt CMC 40 fot container.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4124 RegSvcs.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2392 wrote to memory of 4124 2392 RFQ SN00954666 for prosjekt CMC 40 fot container.exe 82 PID 2392 wrote to memory of 4124 2392 RFQ SN00954666 for prosjekt CMC 40 fot container.exe 82 PID 2392 wrote to memory of 4124 2392 RFQ SN00954666 for prosjekt CMC 40 fot container.exe 82 PID 2392 wrote to memory of 4124 2392 RFQ SN00954666 for prosjekt CMC 40 fot container.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ SN00954666 for prosjekt CMC 40 fot container.exe"C:\Users\Admin\AppData\Local\Temp\RFQ SN00954666 for prosjekt CMC 40 fot container.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RFQ SN00954666 for prosjekt CMC 40 fot container.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124
-