Analysis
-
max time kernel
109s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-01-2025 03:45
Static task
static1
Behavioral task
behavioral1
Sample
Po Tooling CT24023023 CTA240714.exe
Resource
win7-20241010-en
General
-
Target
Po Tooling CT24023023 CTA240714.exe
-
Size
1.3MB
-
MD5
0ff78cd7bb7650ceae70f16df404c664
-
SHA1
512f82194d080f800d339bb9f18e43329bebfac3
-
SHA256
c2fdf0438984ccabe7c3c032fa7136fec9859cabf00e83d6a5915649fc7e89bb
-
SHA512
77d71a01ca169582234b37b0826796b8c29d6b18577da56f72dc5f828feeeab342e7c63aa06b92acabfcc22a7c674f20dba09dbde01a20c6f4e0726c7d3bb1a3
-
SSDEEP
24576:R93pGRzhB7La7tj41esme5CM4OjBa/n3G9CJMsDBU9ZFncMBeY1qC:RMH91Hme5N23EGMJcRC
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.iaa-airferight.com - Port:
587 - Username:
[email protected] - Password:
webmaster - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2284 created 3424 2284 Po Tooling CT24023023 CTA240714.exe 56 -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Handle.vbs Po Tooling CT24023023 CTA240714.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 api.ipify.org 16 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2284 set thread context of 3320 2284 Po Tooling CT24023023 CTA240714.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Po Tooling CT24023023 CTA240714.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2284 Po Tooling CT24023023 CTA240714.exe 2284 Po Tooling CT24023023 CTA240714.exe 2284 Po Tooling CT24023023 CTA240714.exe 3320 InstallUtil.exe 3320 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2284 Po Tooling CT24023023 CTA240714.exe Token: SeDebugPrivilege 2284 Po Tooling CT24023023 CTA240714.exe Token: SeDebugPrivilege 3320 InstallUtil.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2284 wrote to memory of 3320 2284 Po Tooling CT24023023 CTA240714.exe 82 PID 2284 wrote to memory of 3320 2284 Po Tooling CT24023023 CTA240714.exe 82 PID 2284 wrote to memory of 3320 2284 Po Tooling CT24023023 CTA240714.exe 82 PID 2284 wrote to memory of 3320 2284 Po Tooling CT24023023 CTA240714.exe 82 PID 2284 wrote to memory of 3320 2284 Po Tooling CT24023023 CTA240714.exe 82 PID 2284 wrote to memory of 3320 2284 Po Tooling CT24023023 CTA240714.exe 82 PID 2284 wrote to memory of 3320 2284 Po Tooling CT24023023 CTA240714.exe 82 PID 2284 wrote to memory of 3320 2284 Po Tooling CT24023023 CTA240714.exe 82
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\Po Tooling CT24023023 CTA240714.exe"C:\Users\Admin\AppData\Local\Temp\Po Tooling CT24023023 CTA240714.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3320
-