Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 14:48
Static task
static1
Behavioral task
behavioral1
Sample
Q7bAgeTZB8vmku7.exe
Resource
win7-20241010-en
General
-
Target
Q7bAgeTZB8vmku7.exe
-
Size
731KB
-
MD5
9948091d5e1b566c2573df3d3d1cea91
-
SHA1
7f447c10dfc5d6562a3e7b48868ab972d99d7da4
-
SHA256
8c25a42242f041b0ecfc47164ef25a988b37735dac00a6990f7babd80eaa2487
-
SHA512
b7ef2db21bd6b074d2d4e5ef8f372c5dff78e7ba96247f4cac2017464e0df6c4a2d0bde434b9ebfa1dae24c93a71ee4aea14507d75f78426bd96a840a8950f59
-
SSDEEP
12288:BrOd+Ri3AgFd4q2PUFNd7yz0PvADOlnkv2QHRypn0iJyVR3iFJxmGZjB0jnjXUih:TQ3AgpeUF/e0nADbHcpnByM/d0jnrUm
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pgsu.co.id - Port:
587 - Username:
[email protected] - Password:
Vecls16@Vezs - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2924 powershell.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2152 set thread context of 2876 2152 Q7bAgeTZB8vmku7.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Q7bAgeTZB8vmku7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Q7bAgeTZB8vmku7.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3064 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2152 Q7bAgeTZB8vmku7.exe 2152 Q7bAgeTZB8vmku7.exe 2876 Q7bAgeTZB8vmku7.exe 2876 Q7bAgeTZB8vmku7.exe 2924 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2152 Q7bAgeTZB8vmku7.exe Token: SeDebugPrivilege 2876 Q7bAgeTZB8vmku7.exe Token: SeDebugPrivilege 2924 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2876 Q7bAgeTZB8vmku7.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2152 wrote to memory of 2924 2152 Q7bAgeTZB8vmku7.exe 30 PID 2152 wrote to memory of 2924 2152 Q7bAgeTZB8vmku7.exe 30 PID 2152 wrote to memory of 2924 2152 Q7bAgeTZB8vmku7.exe 30 PID 2152 wrote to memory of 2924 2152 Q7bAgeTZB8vmku7.exe 30 PID 2152 wrote to memory of 3064 2152 Q7bAgeTZB8vmku7.exe 32 PID 2152 wrote to memory of 3064 2152 Q7bAgeTZB8vmku7.exe 32 PID 2152 wrote to memory of 3064 2152 Q7bAgeTZB8vmku7.exe 32 PID 2152 wrote to memory of 3064 2152 Q7bAgeTZB8vmku7.exe 32 PID 2152 wrote to memory of 2812 2152 Q7bAgeTZB8vmku7.exe 34 PID 2152 wrote to memory of 2812 2152 Q7bAgeTZB8vmku7.exe 34 PID 2152 wrote to memory of 2812 2152 Q7bAgeTZB8vmku7.exe 34 PID 2152 wrote to memory of 2812 2152 Q7bAgeTZB8vmku7.exe 34 PID 2152 wrote to memory of 2876 2152 Q7bAgeTZB8vmku7.exe 35 PID 2152 wrote to memory of 2876 2152 Q7bAgeTZB8vmku7.exe 35 PID 2152 wrote to memory of 2876 2152 Q7bAgeTZB8vmku7.exe 35 PID 2152 wrote to memory of 2876 2152 Q7bAgeTZB8vmku7.exe 35 PID 2152 wrote to memory of 2876 2152 Q7bAgeTZB8vmku7.exe 35 PID 2152 wrote to memory of 2876 2152 Q7bAgeTZB8vmku7.exe 35 PID 2152 wrote to memory of 2876 2152 Q7bAgeTZB8vmku7.exe 35 PID 2152 wrote to memory of 2876 2152 Q7bAgeTZB8vmku7.exe 35 PID 2152 wrote to memory of 2876 2152 Q7bAgeTZB8vmku7.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\Q7bAgeTZB8vmku7.exe"C:\Users\Admin\AppData\Local\Temp\Q7bAgeTZB8vmku7.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ODIlHgaFNJ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2924
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ODIlHgaFNJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFB40.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3064
-
-
C:\Users\Admin\AppData\Local\Temp\Q7bAgeTZB8vmku7.exe"C:\Users\Admin\AppData\Local\Temp\Q7bAgeTZB8vmku7.exe"2⤵PID:2812
-
-
C:\Users\Admin\AppData\Local\Temp\Q7bAgeTZB8vmku7.exe"C:\Users\Admin\AppData\Local\Temp\Q7bAgeTZB8vmku7.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2876
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e4f633e70be5caf6d61ddf49c982d64e
SHA1534b948e4fed5774a5b717e874c32a51f99b69e4
SHA25675f53eb39fa12f48fd722188839b7eba22541d7556c54939ed1fc1e16489082d
SHA5125a6d4a20f68d54a4fec0d4f7ae98c48ee9fba3cbfa7f0d78e4f2c5afbe2ccdcb45216c9707f77b8e46966ed467773c42510768c66e94d903ab172da3c070b2ca