Overview
overview
10Static
static
5OC 129075-...D).zip
windows7-x64
1OC 129075-...D).zip
windows10-2004-x64
1fd9916fc84...d9.eml
windows7-x64
5fd9916fc84...d9.eml
windows10-2004-x64
3OC 129075-JG-3229.rar
windows7-x64
10OC 129075-JG-3229.rar
windows10-2004-x64
1OC 129075-JG-3229.exe
windows7-x64
10OC 129075-JG-3229.exe
windows10-2004-x64
10Analysis
-
max time kernel
64s -
max time network
65s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 20:32
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
OC 129075-JG-3229-password(Af9X1p8D).zip
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
OC 129075-JG-3229-password(Af9X1p8D).zip
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
fd9916fc84093309bed7643c13a15d64e03b2b5a0afdf384ba68cf7fe3e35cd9.eml
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
fd9916fc84093309bed7643c13a15d64e03b2b5a0afdf384ba68cf7fe3e35cd9.eml
Resource
win10v2004-20250314-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
OC 129075-JG-3229.rar
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral6
Sample
OC 129075-JG-3229.rar
Resource
win10v2004-20250314-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
OC 129075-JG-3229.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
General
-
Target
OC 129075-JG-3229.rar
-
Size
550KB
-
MD5
92ca133e27d245b891b865b36a8eaacc
-
SHA1
b945e869e422f972cf23370fec8c9f141a174c7a
-
SHA256
36fe9874c1c7e5c083ca7780dfe57018f5057ca1989472132a2d877409cb1f78
-
SHA512
494e7a820fc034a61f15fa7f77035f95a56b9b33fcb17af97b9b2bbddffad181a9492fcaf318284b8912d1f1f1c07be31611ee60864076eebcfadea3696944be
-
SSDEEP
12288:llOdZ9ZUIZ7vBN/2aS5LuYBlcCUf03KQMIKml77EG:l4dpBOhP0fJ7ml77
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: ftp- Host:
ftp://ftp.stingatoareincendii.ro - Port:
21 - Username:
[email protected] - Password:
3.*RYhlG)lkA
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Executes dropped EXE 7 IoCs
pid Process 2932 OC 129075-JG-3229.exe 3004 OC 129075-JG-3229.exe 2644 OC 129075-JG-3229.exe 596 OC 129075-JG-3229.exe 3024 OC 129075-JG-3229.exe 2208 OC 129075-JG-3229.exe 2200 OC 129075-JG-3229.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ip-api.com 14 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral5/files/0x0031000000016dd0-4.dat autoit_exe -
Suspicious use of SetThreadContext 7 IoCs
description pid Process procid_target PID 2932 set thread context of 2600 2932 OC 129075-JG-3229.exe 31 PID 3004 set thread context of 2372 3004 OC 129075-JG-3229.exe 35 PID 2644 set thread context of 1632 2644 OC 129075-JG-3229.exe 36 PID 596 set thread context of 1160 596 OC 129075-JG-3229.exe 38 PID 3024 set thread context of 836 3024 OC 129075-JG-3229.exe 40 PID 2208 set thread context of 700 2208 OC 129075-JG-3229.exe 42 PID 2200 set thread context of 1156 2200 OC 129075-JG-3229.exe 44 -
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OC 129075-JG-3229.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OC 129075-JG-3229.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OC 129075-JG-3229.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OC 129075-JG-3229.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OC 129075-JG-3229.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OC 129075-JG-3229.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OC 129075-JG-3229.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 2324 7zFM.exe 2600 RegSvcs.exe 2600 RegSvcs.exe 2324 7zFM.exe 2372 RegSvcs.exe 2372 RegSvcs.exe 2324 7zFM.exe 2324 7zFM.exe 2324 7zFM.exe 1632 RegSvcs.exe 1632 RegSvcs.exe 2324 7zFM.exe 2324 7zFM.exe 1160 RegSvcs.exe 1160 RegSvcs.exe 2324 7zFM.exe 2324 7zFM.exe 2324 7zFM.exe 836 RegSvcs.exe 836 RegSvcs.exe 2324 7zFM.exe 2324 7zFM.exe 700 RegSvcs.exe 700 RegSvcs.exe 2324 7zFM.exe 2324 7zFM.exe 1156 RegSvcs.exe 1156 RegSvcs.exe 2324 7zFM.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2324 7zFM.exe -
Suspicious behavior: MapViewOfSection 10 IoCs
pid Process 2932 OC 129075-JG-3229.exe 3004 OC 129075-JG-3229.exe 2644 OC 129075-JG-3229.exe 2644 OC 129075-JG-3229.exe 596 OC 129075-JG-3229.exe 3024 OC 129075-JG-3229.exe 2208 OC 129075-JG-3229.exe 2208 OC 129075-JG-3229.exe 2200 OC 129075-JG-3229.exe 2200 OC 129075-JG-3229.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeRestorePrivilege 2324 7zFM.exe Token: 35 2324 7zFM.exe Token: SeSecurityPrivilege 2324 7zFM.exe Token: SeDebugPrivilege 2600 RegSvcs.exe Token: SeSecurityPrivilege 2324 7zFM.exe Token: SeSecurityPrivilege 2324 7zFM.exe Token: SeDebugPrivilege 2372 RegSvcs.exe Token: SeDebugPrivilege 1632 RegSvcs.exe Token: SeSecurityPrivilege 2324 7zFM.exe Token: SeDebugPrivilege 1160 RegSvcs.exe Token: SeSecurityPrivilege 2324 7zFM.exe Token: SeDebugPrivilege 836 RegSvcs.exe Token: SeSecurityPrivilege 2324 7zFM.exe Token: SeDebugPrivilege 700 RegSvcs.exe Token: SeSecurityPrivilege 2324 7zFM.exe Token: SeDebugPrivilege 1156 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 22 IoCs
pid Process 2324 7zFM.exe 2324 7zFM.exe 2932 OC 129075-JG-3229.exe 2932 OC 129075-JG-3229.exe 2324 7zFM.exe 3004 OC 129075-JG-3229.exe 3004 OC 129075-JG-3229.exe 2324 7zFM.exe 2644 OC 129075-JG-3229.exe 2644 OC 129075-JG-3229.exe 2324 7zFM.exe 596 OC 129075-JG-3229.exe 596 OC 129075-JG-3229.exe 2324 7zFM.exe 3024 OC 129075-JG-3229.exe 3024 OC 129075-JG-3229.exe 2324 7zFM.exe 2208 OC 129075-JG-3229.exe 2208 OC 129075-JG-3229.exe 2324 7zFM.exe 2200 OC 129075-JG-3229.exe 2200 OC 129075-JG-3229.exe -
Suspicious use of SendNotifyMessage 14 IoCs
pid Process 2932 OC 129075-JG-3229.exe 2932 OC 129075-JG-3229.exe 3004 OC 129075-JG-3229.exe 3004 OC 129075-JG-3229.exe 2644 OC 129075-JG-3229.exe 2644 OC 129075-JG-3229.exe 596 OC 129075-JG-3229.exe 596 OC 129075-JG-3229.exe 3024 OC 129075-JG-3229.exe 3024 OC 129075-JG-3229.exe 2208 OC 129075-JG-3229.exe 2208 OC 129075-JG-3229.exe 2200 OC 129075-JG-3229.exe 2200 OC 129075-JG-3229.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2932 2324 7zFM.exe 30 PID 2324 wrote to memory of 2932 2324 7zFM.exe 30 PID 2324 wrote to memory of 2932 2324 7zFM.exe 30 PID 2324 wrote to memory of 2932 2324 7zFM.exe 30 PID 2932 wrote to memory of 2600 2932 OC 129075-JG-3229.exe 31 PID 2932 wrote to memory of 2600 2932 OC 129075-JG-3229.exe 31 PID 2932 wrote to memory of 2600 2932 OC 129075-JG-3229.exe 31 PID 2932 wrote to memory of 2600 2932 OC 129075-JG-3229.exe 31 PID 2932 wrote to memory of 2600 2932 OC 129075-JG-3229.exe 31 PID 2932 wrote to memory of 2600 2932 OC 129075-JG-3229.exe 31 PID 2932 wrote to memory of 2600 2932 OC 129075-JG-3229.exe 31 PID 2932 wrote to memory of 2600 2932 OC 129075-JG-3229.exe 31 PID 2324 wrote to memory of 3004 2324 7zFM.exe 33 PID 2324 wrote to memory of 3004 2324 7zFM.exe 33 PID 2324 wrote to memory of 3004 2324 7zFM.exe 33 PID 2324 wrote to memory of 3004 2324 7zFM.exe 33 PID 2324 wrote to memory of 2644 2324 7zFM.exe 34 PID 2324 wrote to memory of 2644 2324 7zFM.exe 34 PID 2324 wrote to memory of 2644 2324 7zFM.exe 34 PID 2324 wrote to memory of 2644 2324 7zFM.exe 34 PID 3004 wrote to memory of 2372 3004 OC 129075-JG-3229.exe 35 PID 3004 wrote to memory of 2372 3004 OC 129075-JG-3229.exe 35 PID 3004 wrote to memory of 2372 3004 OC 129075-JG-3229.exe 35 PID 3004 wrote to memory of 2372 3004 OC 129075-JG-3229.exe 35 PID 3004 wrote to memory of 2372 3004 OC 129075-JG-3229.exe 35 PID 3004 wrote to memory of 2372 3004 OC 129075-JG-3229.exe 35 PID 3004 wrote to memory of 2372 3004 OC 129075-JG-3229.exe 35 PID 3004 wrote to memory of 2372 3004 OC 129075-JG-3229.exe 35 PID 2644 wrote to memory of 1632 2644 OC 129075-JG-3229.exe 36 PID 2644 wrote to memory of 1632 2644 OC 129075-JG-3229.exe 36 PID 2644 wrote to memory of 1632 2644 OC 129075-JG-3229.exe 36 PID 2644 wrote to memory of 1632 2644 OC 129075-JG-3229.exe 36 PID 2644 wrote to memory of 1632 2644 OC 129075-JG-3229.exe 36 PID 2644 wrote to memory of 1632 2644 OC 129075-JG-3229.exe 36 PID 2644 wrote to memory of 1632 2644 OC 129075-JG-3229.exe 36 PID 2644 wrote to memory of 1632 2644 OC 129075-JG-3229.exe 36 PID 2324 wrote to memory of 596 2324 7zFM.exe 37 PID 2324 wrote to memory of 596 2324 7zFM.exe 37 PID 2324 wrote to memory of 596 2324 7zFM.exe 37 PID 2324 wrote to memory of 596 2324 7zFM.exe 37 PID 596 wrote to memory of 1160 596 OC 129075-JG-3229.exe 38 PID 596 wrote to memory of 1160 596 OC 129075-JG-3229.exe 38 PID 596 wrote to memory of 1160 596 OC 129075-JG-3229.exe 38 PID 596 wrote to memory of 1160 596 OC 129075-JG-3229.exe 38 PID 596 wrote to memory of 1160 596 OC 129075-JG-3229.exe 38 PID 596 wrote to memory of 1160 596 OC 129075-JG-3229.exe 38 PID 596 wrote to memory of 1160 596 OC 129075-JG-3229.exe 38 PID 596 wrote to memory of 1160 596 OC 129075-JG-3229.exe 38 PID 2324 wrote to memory of 3024 2324 7zFM.exe 39 PID 2324 wrote to memory of 3024 2324 7zFM.exe 39 PID 2324 wrote to memory of 3024 2324 7zFM.exe 39 PID 2324 wrote to memory of 3024 2324 7zFM.exe 39 PID 3024 wrote to memory of 836 3024 OC 129075-JG-3229.exe 40 PID 3024 wrote to memory of 836 3024 OC 129075-JG-3229.exe 40 PID 3024 wrote to memory of 836 3024 OC 129075-JG-3229.exe 40 PID 3024 wrote to memory of 836 3024 OC 129075-JG-3229.exe 40 PID 3024 wrote to memory of 836 3024 OC 129075-JG-3229.exe 40 PID 3024 wrote to memory of 836 3024 OC 129075-JG-3229.exe 40 PID 3024 wrote to memory of 836 3024 OC 129075-JG-3229.exe 40 PID 3024 wrote to memory of 836 3024 OC 129075-JG-3229.exe 40 PID 2324 wrote to memory of 2208 2324 7zFM.exe 41 PID 2324 wrote to memory of 2208 2324 7zFM.exe 41 PID 2324 wrote to memory of 2208 2324 7zFM.exe 41 PID 2324 wrote to memory of 2208 2324 7zFM.exe 41
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\OC 129075-JG-3229.rar"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\7zO41945307\OC 129075-JG-3229.exe"C:\Users\Admin\AppData\Local\Temp\7zO41945307\OC 129075-JG-3229.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\7zO41945307\OC 129075-JG-3229.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO419CE807\OC 129075-JG-3229.exe"C:\Users\Admin\AppData\Local\Temp\7zO419CE807\OC 129075-JG-3229.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\7zO419CE807\OC 129075-JG-3229.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO41949907\OC 129075-JG-3229.exe"C:\Users\Admin\AppData\Local\Temp\7zO41949907\OC 129075-JG-3229.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\7zO41949907\OC 129075-JG-3229.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO41918277\OC 129075-JG-3229.exe"C:\Users\Admin\AppData\Local\Temp\7zO41918277\OC 129075-JG-3229.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\7zO41918277\OC 129075-JG-3229.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1160
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO41941747\OC 129075-JG-3229.exe"C:\Users\Admin\AppData\Local\Temp\7zO41941747\OC 129075-JG-3229.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\7zO41941747\OC 129075-JG-3229.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:836
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO4193E187\OC 129075-JG-3229.exe"C:\Users\Admin\AppData\Local\Temp\7zO4193E187\OC 129075-JG-3229.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2208 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\7zO4193E187\OC 129075-JG-3229.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:700
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO41910AF7\OC 129075-JG-3229.exe"C:\Users\Admin\AppData\Local\Temp\7zO41910AF7\OC 129075-JG-3229.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2200 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\7zO41910AF7\OC 129075-JG-3229.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1156
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5ca05eaa8df0531cb2f76d5a2baa5aaea
SHA1688adb6f0a0ab7f13d47d0c16326221e20fa7b10
SHA25666d7d602350b27bd25ca73436b6b7598c65e5022cc8062eb5c87dc604ab97952
SHA5123e59f0eefd60ac5783ab291e89484532f5bf6ab105f83a4f34099815b26375097cf984050f9b00e2c90631cb07b600aa18cba3b93f24b1f4e2d6447a1e7cfdf0
-
Filesize
150KB
MD516011a9ae2a7fdc9e7e1612b4efe31ae
SHA1d1f62aee7e0396d2e79035a0f8e7dded376636bb
SHA256e55515aab193ad5b319ded7db5213b44bd4a27feeaefc4f5d9db87f13d71bb48
SHA5123def9623ce8a4bb99f522d4e2da4c0b7e4328edc874f509d0d4982845a56cc2310f10d8f85c1c30697454a575d759ffb5d9d4b83d42358f9a6983eb0e4eecd46
-
Filesize
238KB
MD5e858a08a8daa5d4f830d579cc04731ce
SHA177f557077dc8bcafd75574da1a1e47d8bc5c9f16
SHA2562313d87b359da4dedaf95fa676d92ff55b431fd764f8c409aa5e04a4078eef5d
SHA512f671a3d380bcce1c5c0058e4b5cc13cb6fe607006e5ca6291a152cf67b04d945ea0fee0065c4b510f52b4722a8f37ff44797e9661ad05348ed3d7f29403c6908