Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2024, 01:03
Behavioral task
behavioral1
Sample
0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe
Resource
win7-20240903-en
General
-
Target
0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe
-
Size
599KB
-
MD5
9b46500828b338eb4cda1d49bed1f791
-
SHA1
fe2f2d5e222765e585a61f80c33b061f643e7107
-
SHA256
0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9
-
SHA512
5a6e39f1064f7a1db77fe8aab9da039f9340630ecf1379ef28061d857908107ccc884389fdc064d13b5c80fabc417d5d4061a718465f0301e9494c8db109e918
-
SSDEEP
12288:AYV6MorX7qzuC3QHO9FQVHPF51jgcQxNAQ8d6dLOXsGdxpM8E:fBXu9HGaVHdkLO/LE
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.antoniomayol.com:21 - Port:
21 - Username:
[email protected] - Password:
cMhKDQUk1{;%
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\outvaunts.vbs outvaunts.exe -
Executes dropped EXE 1 IoCs
pid Process 1576 outvaunts.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4592-12-0x00000000003B0000-0x0000000000509000-memory.dmp autoit_exe behavioral2/memory/1576-22-0x0000000001830000-0x0000000001C30000-memory.dmp autoit_exe behavioral2/memory/1576-26-0x0000000000A30000-0x0000000000B89000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1576 set thread context of 2548 1576 outvaunts.exe 88 -
resource yara_rule behavioral2/memory/4592-0-0x00000000003B0000-0x0000000000509000-memory.dmp upx behavioral2/files/0x000a000000023b89-10.dat upx behavioral2/memory/1576-13-0x0000000000A30000-0x0000000000B89000-memory.dmp upx behavioral2/memory/4592-12-0x00000000003B0000-0x0000000000509000-memory.dmp upx behavioral2/memory/1576-26-0x0000000000A30000-0x0000000000B89000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2548 RegSvcs.exe 2548 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1576 outvaunts.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2548 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4592 0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe 4592 0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe 1576 outvaunts.exe 1576 outvaunts.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 4592 0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe 4592 0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe 1576 outvaunts.exe 1576 outvaunts.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4592 wrote to memory of 1576 4592 0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe 87 PID 4592 wrote to memory of 1576 4592 0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe 87 PID 4592 wrote to memory of 1576 4592 0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe 87 PID 1576 wrote to memory of 2548 1576 outvaunts.exe 88 PID 1576 wrote to memory of 2548 1576 outvaunts.exe 88 PID 1576 wrote to memory of 2548 1576 outvaunts.exe 88 PID 1576 wrote to memory of 2548 1576 outvaunts.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe"C:\Users\Admin\AppData\Local\Temp\0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\kinematical\outvaunts.exe"C:\Users\Admin\AppData\Local\Temp\0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
239KB
MD5bfe52729d63dc4e1d9d17cf71636ff77
SHA1451594448e8a3292016c5782ec4cd5474711c90a
SHA25670ed8c3a103bb5402268ee205f24b77566c8cf12b7a38e9ee94fe2c844ab1835
SHA512c3f303b7383a3a7528af556befc939c227f6c5246beb9b9ff3a5d97a537bb4d8c6da6fc6a45faec5d1c8c2f489dca788bdb792e2dc91dda71149ab6234cb4b92
-
Filesize
599KB
MD59b46500828b338eb4cda1d49bed1f791
SHA1fe2f2d5e222765e585a61f80c33b061f643e7107
SHA2560502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9
SHA5125a6e39f1064f7a1db77fe8aab9da039f9340630ecf1379ef28061d857908107ccc884389fdc064d13b5c80fabc417d5d4061a718465f0301e9494c8db109e918