Analysis

  • max time kernel
    103s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 12:51

General

  • Target

    cali.exe

  • Size

    234KB

  • MD5

    cae505e91242b082fefcf521b25d02f5

  • SHA1

    049fe643f4807770cee9d8163bd739763a693a8e

  • SHA256

    053eb54af528f36c930565abc0ae8888dc8ea7c8740dcb25e02cad88a26dfe34

  • SHA512

    af0ebee48424a0219a242fef737e9b842d345fbb94920284d8c83875e14319731c2bf1a2dba66bd45e57cb0e836ef2d5857832ec87f39768b2b19b1d1da8cd44

  • SSDEEP

    3072:BSy67Cmyuy/F168rR5bip59R/aAUaf8F5DGDdU1:BSykCmyuy/F168rLbipzv8yDW

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    pin@hm-heating-de.icu
  • Password:
    mGr{)g5TVG3j

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    pin@hm-heating-de.icu
  • Password:
    mGr{)g5TVG3j
  • Email To:
    gbenedick.amesgc@protonmail.com

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\cali.exe
    "C:\Users\Admin\AppData\Local\Temp\cali.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:776

Network

  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    69.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    69.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    api.ipify.org
    cali.exe
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN A
    172.67.74.152
    api.ipify.org
    IN A
    104.26.13.205
    api.ipify.org
    IN A
    104.26.12.205
  • flag-us
    GET
    https://api.ipify.org/
    cali.exe
    Remote address:
    172.67.74.152:443
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
    Host: api.ipify.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Wed, 18 Dec 2024 12:51:37 GMT
    Content-Type: text/plain
    Content-Length: 14
    Connection: keep-alive
    Vary: Origin
    cf-cache-status: DYNAMIC
    Server: cloudflare
    CF-RAY: 8f3f490e6c0ced0c-LHR
    server-timing: cfL4;desc="?proto=TCP&rtt=32808&min_rtt=26058&rtt_var=17866&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2980&recv_bytes=452&delivery_rate=122727&cwnd=253&unsent_bytes=0&cid=71f7af6c2ec8a35d&ts=197&x=0"
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    152.74.67.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    152.74.67.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    mail.privateemail.com
    cali.exe
    Remote address:
    8.8.8.8:53
    Request
    mail.privateemail.com
    IN A
    Response
    mail.privateemail.com
    IN A
    198.54.122.135
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    135.122.54.198.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    135.122.54.198.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.42.69.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.42.69.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    134.130.81.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    134.130.81.91.in-addr.arpa
    IN PTR
    Response
  • 172.67.74.152:443
    https://api.ipify.org/
    tls, http
    cali.exe
    900 B
    3.8kB
    10
    9

    HTTP Request

    GET https://api.ipify.org/

    HTTP Response

    200
  • 198.54.122.135:587
    mail.privateemail.com
    smtp-submission
    cali.exe
    2.8kB
    7.4kB
    22
    32
  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    69.31.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    69.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    api.ipify.org
    dns
    cali.exe
    59 B
    107 B
    1
    1

    DNS Request

    api.ipify.org

    DNS Response

    172.67.74.152
    104.26.13.205
    104.26.12.205

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    152.74.67.172.in-addr.arpa
    dns
    72 B
    134 B
    1
    1

    DNS Request

    152.74.67.172.in-addr.arpa

  • 8.8.8.8:53
    mail.privateemail.com
    dns
    cali.exe
    67 B
    83 B
    1
    1

    DNS Request

    mail.privateemail.com

    DNS Response

    198.54.122.135

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    135.122.54.198.in-addr.arpa
    dns
    73 B
    153 B
    1
    1

    DNS Request

    135.122.54.198.in-addr.arpa

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
    156 B
    1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    241.42.69.40.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    241.42.69.40.in-addr.arpa

  • 8.8.8.8:53
    134.130.81.91.in-addr.arpa
    dns
    72 B
    147 B
    1
    1

    DNS Request

    134.130.81.91.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/776-0-0x0000000074CDE000-0x0000000074CDF000-memory.dmp

    Filesize

    4KB

  • memory/776-1-0x0000000000D50000-0x0000000000D90000-memory.dmp

    Filesize

    256KB

  • memory/776-2-0x0000000005E50000-0x00000000063F4000-memory.dmp

    Filesize

    5.6MB

  • memory/776-3-0x00000000058A0000-0x0000000005906000-memory.dmp

    Filesize

    408KB

  • memory/776-4-0x0000000074CD0000-0x0000000075480000-memory.dmp

    Filesize

    7.7MB

  • memory/776-5-0x0000000006F50000-0x0000000006FA0000-memory.dmp

    Filesize

    320KB

  • memory/776-6-0x0000000007040000-0x00000000070DC000-memory.dmp

    Filesize

    624KB

  • memory/776-7-0x0000000007180000-0x0000000007212000-memory.dmp

    Filesize

    584KB

  • memory/776-8-0x00000000070F0000-0x00000000070FA000-memory.dmp

    Filesize

    40KB

  • memory/776-9-0x0000000074CDE000-0x0000000074CDF000-memory.dmp

    Filesize

    4KB

  • memory/776-10-0x0000000074CD0000-0x0000000075480000-memory.dmp

    Filesize

    7.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.