Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/01/2025, 16:30
Behavioral task
behavioral1
Sample
Sigmanly_811c8854ea3adcd1259c28cf1dc60e0a0a2f7a44f463e98f77c277a2a2f6394b.exe
Resource
win7-20240729-en
General
-
Target
Sigmanly_811c8854ea3adcd1259c28cf1dc60e0a0a2f7a44f463e98f77c277a2a2f6394b.exe
-
Size
538KB
-
MD5
fc76d8b178c0aa094eba5fea74e82614
-
SHA1
f2f88413e1e3aed4fd731769037c3d2391d29c94
-
SHA256
811c8854ea3adcd1259c28cf1dc60e0a0a2f7a44f463e98f77c277a2a2f6394b
-
SHA512
72f5ca123610cbc3ccee6630148c61e99f8ddbffbbe835eb2bf323a0a6d5f2fdd57bafa139595e62ea485f2086b1dd46f994281070639cd5e7ff89eb3422fd2b
-
SSDEEP
12288:ZOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiGDtC2ajbP50s3o32+:Zq5TfcdHj4fmbcv13GV
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.antoniomayol.com:21 - Port:
21 - Username:
[email protected] - Password:
cMhKDQUk1{;%
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\unjuridically.vbs unjuridically.exe -
Executes dropped EXE 1 IoCs
pid Process 5052 unjuridically.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 ip-api.com -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2992-19-0x0000000000060000-0x000000000019F000-memory.dmp autoit_exe behavioral2/memory/5052-33-0x0000000001860000-0x0000000001C60000-memory.dmp autoit_exe behavioral2/memory/5052-37-0x0000000000510000-0x000000000064F000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5052 set thread context of 4444 5052 unjuridically.exe 84 -
resource yara_rule behavioral2/memory/2992-0-0x0000000000060000-0x000000000019F000-memory.dmp upx behavioral2/files/0x0007000000023c95-15.dat upx behavioral2/memory/5052-17-0x0000000000510000-0x000000000064F000-memory.dmp upx behavioral2/memory/2992-19-0x0000000000060000-0x000000000019F000-memory.dmp upx behavioral2/memory/5052-37-0x0000000000510000-0x000000000064F000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sigmanly_811c8854ea3adcd1259c28cf1dc60e0a0a2f7a44f463e98f77c277a2a2f6394b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unjuridically.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4444 RegSvcs.exe 4444 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5052 unjuridically.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4444 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2992 Sigmanly_811c8854ea3adcd1259c28cf1dc60e0a0a2f7a44f463e98f77c277a2a2f6394b.exe 2992 Sigmanly_811c8854ea3adcd1259c28cf1dc60e0a0a2f7a44f463e98f77c277a2a2f6394b.exe 5052 unjuridically.exe 5052 unjuridically.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2992 Sigmanly_811c8854ea3adcd1259c28cf1dc60e0a0a2f7a44f463e98f77c277a2a2f6394b.exe 2992 Sigmanly_811c8854ea3adcd1259c28cf1dc60e0a0a2f7a44f463e98f77c277a2a2f6394b.exe 5052 unjuridically.exe 5052 unjuridically.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2992 wrote to memory of 5052 2992 Sigmanly_811c8854ea3adcd1259c28cf1dc60e0a0a2f7a44f463e98f77c277a2a2f6394b.exe 83 PID 2992 wrote to memory of 5052 2992 Sigmanly_811c8854ea3adcd1259c28cf1dc60e0a0a2f7a44f463e98f77c277a2a2f6394b.exe 83 PID 2992 wrote to memory of 5052 2992 Sigmanly_811c8854ea3adcd1259c28cf1dc60e0a0a2f7a44f463e98f77c277a2a2f6394b.exe 83 PID 5052 wrote to memory of 4444 5052 unjuridically.exe 84 PID 5052 wrote to memory of 4444 5052 unjuridically.exe 84 PID 5052 wrote to memory of 4444 5052 unjuridically.exe 84 PID 5052 wrote to memory of 4444 5052 unjuridically.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sigmanly_811c8854ea3adcd1259c28cf1dc60e0a0a2f7a44f463e98f77c277a2a2f6394b.exe"C:\Users\Admin\AppData\Local\Temp\Sigmanly_811c8854ea3adcd1259c28cf1dc60e0a0a2f7a44f463e98f77c277a2a2f6394b.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Lityerses\unjuridically.exe"C:\Users\Admin\AppData\Local\Temp\Sigmanly_811c8854ea3adcd1259c28cf1dc60e0a0a2f7a44f463e98f77c277a2a2f6394b.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Sigmanly_811c8854ea3adcd1259c28cf1dc60e0a0a2f7a44f463e98f77c277a2a2f6394b.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4444
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
538KB
MD5fc76d8b178c0aa094eba5fea74e82614
SHA1f2f88413e1e3aed4fd731769037c3d2391d29c94
SHA256811c8854ea3adcd1259c28cf1dc60e0a0a2f7a44f463e98f77c277a2a2f6394b
SHA51272f5ca123610cbc3ccee6630148c61e99f8ddbffbbe835eb2bf323a0a6d5f2fdd57bafa139595e62ea485f2086b1dd46f994281070639cd5e7ff89eb3422fd2b
-
Filesize
239KB
MD5fd16ac67e115a223cc50f5019a3f052b
SHA11d703ac8ff6eb9450697cd1876405ae608e9cf37
SHA25611374f7b169a7dd18927070d7961f1050fc8b6a98b9803eb15a2687f4a62d89d
SHA512593582a3d9eb4d2a9e0a35099819a14fd3b6633456a2f33c48652bf97f615e34abc435bdf7c9144e54f9e7d6b88480110892b51e9d5d29e73698b80d493ef2fd