Overview
overview
10Static
static
372553f4f79...cf.exe
windows7-x64
1072553f4f79...cf.exe
windows10-2004-x64
10$PLUGINSDI...ge.dll
windows7-x64
1$PLUGINSDI...ge.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Analysis
-
max time kernel
141s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
02-07-2024 01:31
Static task
static1
Behavioral task
behavioral1
Sample
72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/BgImage.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/BgImage.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
General
-
Target
72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe
-
Size
497KB
-
MD5
610c22dff8f1f7d12746e879be25d778
-
SHA1
158ec97fd4604350430ceeeac61f15f386094e9f
-
SHA256
72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf
-
SHA512
b6864d1d0479aa9b9d2689519a5f84d7a889e1c21e95dd30edc49235b7873740a92ff5f0ba8a650882e7fa9c1767a7238b63e50f2c9510d5384312f895443fcd
-
SSDEEP
12288:c19+dlfwYKZWeg6GVH9v7YtI1CWQeUM6WYaCgIwRMaoGiPF:PdloYK7g6GVN7WyUMvIwRgGQ
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://mail.hearing-vision.com - Port:
21 - Username:
[email protected] - Password:
LILKOOLL14!
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 4 IoCs
Processes:
72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exepid process 1848 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe 1848 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe 1848 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe 1848 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 ip-api.com -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exepid process 1100 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exepid process 1848 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe 1100 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exedescription pid process target process PID 1848 set thread context of 1100 1848 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe -
Drops file in Program Files directory 1 IoCs
Processes:
72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exedescription ioc process File opened for modification C:\Program Files (x86)\immunologis.Byg 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exepid process 1100 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe 1100 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exepid process 1848 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exedescription pid process Token: SeDebugPrivilege 1100 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exedescription pid process target process PID 1848 wrote to memory of 1100 1848 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe PID 1848 wrote to memory of 1100 1848 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe PID 1848 wrote to memory of 1100 1848 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe PID 1848 wrote to memory of 1100 1848 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe PID 1848 wrote to memory of 1100 1848 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe PID 1848 wrote to memory of 1100 1848 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe 72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe"C:\Users\Admin\AppData\Local\Temp\72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe"C:\Users\Admin\AppData\Local\Temp\72553f4f7953a79115252ea22d00ed3aae235f637ce2e44d531b36af06d9b6cf.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsi20AB.tmp\BgImage.dllFilesize
7KB
MD52d5f40ddc34e9dc8f43b5bf1f61301e3
SHA15ed3cd47affc4d55750e738581fce2b40158c825
SHA256785944e57e8e4971f46f84a07d82dee2ab4e14a68543d83bfe7be7d5cda83143
SHA512605cebcc480cb71ba8241782d89e030a5c01e1359accbde174cb6bdaf249167347ecb06e3781cb9b1cc4b465cef95f1663f0d9766ed84ebade87aa3970765b3e
-
\Users\Admin\AppData\Local\Temp\nsi20AB.tmp\System.dllFilesize
12KB
MD512b140583e3273ee1f65016becea58c4
SHA192df24d11797fefd2e1f8d29be9dfd67c56c1ada
SHA256014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
SHA51249ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
-
\Users\Admin\AppData\Local\Temp\nsi20AB.tmp\UserInfo.dllFilesize
4KB
MD590228dd140188ec0ca02f7f52e4c9a30
SHA16880d9aeec4c97c4b7718044c9c59b92379feaca
SHA25654bcf3d018734b884bd33a74a05eea0ac3c83501acbdb71ea8ec56ec9402a263
SHA5121a38b1ebb9e2440dd240c8cd2406261e21b544ed392f808d36f78590075f854d89e624589bfddabcace96b33a7f3084c7686351bd66ae07ec035bbef94ef8da2
-
\Users\Admin\AppData\Local\Temp\nsi20AB.tmp\nsExec.dllFilesize
6KB
MD54a2f4fe4a3ad1de56ee6bf7dd4923963
SHA17cc68b94448c964fd99904e5784b059aed4d5daa
SHA25689b1e6509a1b45b32933e9d785a9c8c5b9ce7c616e1112dcf7fc3fa5ca27ebde
SHA5124b6bbe75beafae9a29932ff5ddd3940aadfae62c157836e6cdab755955782dd5354d5eb389b4b8c16bf59f4ce7a099a0161d915c1cf2968f28e195dc8e3997ea
-
memory/1100-46-0x0000000077C10000-0x0000000077DB9000-memory.dmpFilesize
1.7MB
-
memory/1100-47-0x0000000000480000-0x00000000014E2000-memory.dmpFilesize
16.4MB
-
memory/1100-49-0x0000000000480000-0x00000000004C2000-memory.dmpFilesize
264KB
-
memory/1848-43-0x0000000003800000-0x0000000005B98000-memory.dmpFilesize
35.6MB
-
memory/1848-44-0x0000000077C11000-0x0000000077D12000-memory.dmpFilesize
1.0MB
-
memory/1848-45-0x0000000077C10000-0x0000000077DB9000-memory.dmpFilesize
1.7MB
-
memory/1848-48-0x0000000003800000-0x0000000005B98000-memory.dmpFilesize
35.6MB