Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 10:02
Static task
static1
Behavioral task
behavioral1
Sample
Potwierdzenie zamówienia.doc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Potwierdzenie zamówienia.doc.exe
Resource
win10v2004-20240508-en
General
-
Target
Potwierdzenie zamówienia.doc.exe
-
Size
768KB
-
MD5
0b2cc11236f4f6cd2ead26a1d02c7a60
-
SHA1
1a9f29f7478792d01bc11bc2cb7c1c9aa2dc4576
-
SHA256
be68709a0e66e6137a003d1dd97dae958cf10ab2cff49d66b8aabcf4b618b9b5
-
SHA512
52ea86584a1817c1a435358a8b3f55e0987dbe7bf43cd8bbf1afcd1a59dc4d42340cfebd71d1510d1f4535065acf123e8a06d4063aa2eda2be6ae5991782ea02
-
SSDEEP
12288:RKcuUYs8wcu0MyQYtM1l6ogb7jahORQUiLcXW3XJ64DGzZBueipqDKM1o33:QcdYsdcX3QwSlsbahCEcXWZ64mZBWM1+
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.caldas-cca.com - Port:
587 - Username:
[email protected] - Password:
M34gN34sZS0Az - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 api.ipify.org 8 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Potwierdzenie zamówienia.doc.exedescription pid process target process PID 2212 set thread context of 2552 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Potwierdzenie zamówienia.doc.exeInstallUtil.exepid process 2212 Potwierdzenie zamówienia.doc.exe 2212 Potwierdzenie zamówienia.doc.exe 2212 Potwierdzenie zamówienia.doc.exe 2552 InstallUtil.exe 2552 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Potwierdzenie zamówienia.doc.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 2212 Potwierdzenie zamówienia.doc.exe Token: SeDebugPrivilege 2552 InstallUtil.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
Potwierdzenie zamówienia.doc.exedescription pid process target process PID 2212 wrote to memory of 2600 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2600 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2600 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2600 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2600 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2600 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2600 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2600 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2600 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2600 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2600 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2600 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2552 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2552 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2552 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2552 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2552 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2552 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2552 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2552 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2552 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2552 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2552 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe PID 2212 wrote to memory of 2552 2212 Potwierdzenie zamówienia.doc.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Potwierdzenie zamówienia.doc.exe"C:\Users\Admin\AppData\Local\Temp\Potwierdzenie zamówienia.doc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2212-24-0x00000000745D0000-0x0000000074CBE000-memory.dmpFilesize
6.9MB
-
memory/2212-1-0x0000000000DA0000-0x0000000000E66000-memory.dmpFilesize
792KB
-
memory/2212-29-0x00000000745D0000-0x0000000074CBE000-memory.dmpFilesize
6.9MB
-
memory/2212-3-0x00000000009F0000-0x0000000000A34000-memory.dmpFilesize
272KB
-
memory/2212-4-0x00000000745DE000-0x00000000745DF000-memory.dmpFilesize
4KB
-
memory/2212-5-0x00000000745D0000-0x0000000074CBE000-memory.dmpFilesize
6.9MB
-
memory/2212-6-0x0000000000B70000-0x0000000000B8A000-memory.dmpFilesize
104KB
-
memory/2212-7-0x00000000007A0000-0x00000000007A6000-memory.dmpFilesize
24KB
-
memory/2212-8-0x00000000745D0000-0x0000000074CBE000-memory.dmpFilesize
6.9MB
-
memory/2212-0-0x00000000745DE000-0x00000000745DF000-memory.dmpFilesize
4KB
-
memory/2212-2-0x00000000745D0000-0x0000000074CBE000-memory.dmpFilesize
6.9MB
-
memory/2552-31-0x00000000745D0000-0x0000000074CBE000-memory.dmpFilesize
6.9MB
-
memory/2552-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2552-25-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2552-27-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2552-28-0x00000000745D0000-0x0000000074CBE000-memory.dmpFilesize
6.9MB
-
memory/2552-26-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/2552-30-0x00000000745D0000-0x0000000074CBE000-memory.dmpFilesize
6.9MB
-
memory/2600-9-0x0000000000090000-0x00000000000D0000-memory.dmpFilesize
256KB
-
memory/2600-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2600-14-0x0000000000090000-0x00000000000D0000-memory.dmpFilesize
256KB
-
memory/2600-11-0x0000000000090000-0x00000000000D0000-memory.dmpFilesize
256KB
-
memory/2600-12-0x0000000000090000-0x00000000000D0000-memory.dmpFilesize
256KB