agenttesla | 75c5452fe55b5b42e88f7e22cf3d54665f639f721b55dbafa78b43c644f1b598

Analysis

max time kernel
274s
max time network
303s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b0b93c3f2b8fee5d774436447b4990f.js
Size

37KB
MD5

aa015cde14808315df0e50fc98fa8ca1
SHA1

499fd482cd7bad8d905564983f07e7ae822ea189
SHA256

75c5452fe55b5b42e88f7e22cf3d54665f639f721b55dbafa78b43c644f1b598
SHA512

08af4131b97d2177723bbc23981286f6f22e780db6d6f0e8894048fc971eb3cee3109b1daebe31107c2119d48ba0423625e6fbce180e6b9bc1fecdc56bba6278
SSDEEP

768:NDVC12hDVX/opI7vr3t+borH2OAH1XJLYlCH56v+1KnLmVk:dVCUhRWI7vjtsorWOAH1XJsCH56vwmLz

Score

10^/10

agenttesla vjw0rm wshrat keylogger persistence spyware stealer trojan worm

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot5196374398:AAFia6uLKkD-Wc5-qWTKCU_kRGlxKrfZgpE/

Extracted

Family

wshrat

http://45.139.105.174:7670

Extracted

Family

vjw0rm

http://45.139.105.174:7575

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 32 IoCs

flow	pid	Process
39	3540	wscript.exe
40	4564	wscript.exe
41	4732	wscript.exe
44	4564	wscript.exe
45	4564	wscript.exe
48	3540	wscript.exe
49	4732	wscript.exe
57	4564	wscript.exe
58	4564	wscript.exe
61	4564	wscript.exe
62	4564	wscript.exe
63	3452	wscript.exe
64	4732	wscript.exe
65	3540	wscript.exe
66	4564	wscript.exe
67	4564	wscript.exe
68	4564	wscript.exe
69	4564	wscript.exe
70	4540	WScript.exe
71	4564	wscript.exe
72	4564	wscript.exe
73	4564	wscript.exe
74	3452	wscript.exe
75	3540	wscript.exe
76	4732	wscript.exe
77	4564	wscript.exe
84	4564	wscript.exe
85	4564	wscript.exe
86	3452	wscript.exe
87	4732	wscript.exe
88	3540	wscript.exe
89	4564	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
3164	originn.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 9 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9b0b93c3f2b8fee5d774436447b4990f.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uLXRQKOPod.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wamafa.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uLXRQKOPod.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9b0b93c3f2b8fee5d774436447b4990f.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uLXRQKOPod.js	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ABjiMOejwE.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ABjiMOejwE.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wamafa.js	WScript.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9b0b93c3f2b8fee5d774436447b4990f = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\9b0b93c3f2b8fee5d774436447b4990f.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9b0b93c3f2b8fee5d774436447b4990f = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\9b0b93c3f2b8fee5d774436447b4990f.js\""	wscript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9b0b93c3f2b8fee5d774436447b4990f = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\9b0b93c3f2b8fee5d774436447b4990f.js\""	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ZXKEO321AL = "\"C:\\Users\\Admin\\AppData\\Roaming\\wamafa.js\""	WScript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\software\microsoft\windows\currentversion\run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9b0b93c3f2b8fee5d774436447b4990f = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\9b0b93c3f2b8fee5d774436447b4990f.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	wscript.exe

Script User-Agent 17 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	44	WSHRAT\|EEC18509\|COXNLIOB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	57	WSHRAT\|EEC18509\|COXNLIOB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	67	WSHRAT\|EEC18509\|COXNLIOB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	71	WSHRAT\|EEC18509\|COXNLIOB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	73	WSHRAT\|EEC18509\|COXNLIOB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	84	WSHRAT\|EEC18509\|COXNLIOB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	62	WSHRAT\|EEC18509\|COXNLIOB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	68	WSHRAT\|EEC18509\|COXNLIOB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	69	WSHRAT\|EEC18509\|COXNLIOB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	77	WSHRAT\|EEC18509\|COXNLIOB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	89	WSHRAT\|EEC18509\|COXNLIOB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	85	WSHRAT\|EEC18509\|COXNLIOB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	40	WSHRAT\|EEC18509\|COXNLIOB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	58	WSHRAT\|EEC18509\|COXNLIOB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	61	WSHRAT\|EEC18509\|COXNLIOB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	66	WSHRAT\|EEC18509\|COXNLIOB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/11/2022\|JavaScript
HTTP User-Agent header	72	WSHRAT\|EEC18509\|COXNLIOB\|Admin\|Microsoft Windows 10 Pro\|plus\|nan-av\|false - 29/11/2022\|JavaScript

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 3540	4172	wscript.exe	82
PID 4172 wrote to memory of 3540	4172	wscript.exe	82
PID 4172 wrote to memory of 4564	4172	wscript.exe	83
PID 4172 wrote to memory of 4564	4172	wscript.exe	83
PID 4564 wrote to memory of 4732	4564	wscript.exe	84
PID 4564 wrote to memory of 4732	4564	wscript.exe	84
PID 4564 wrote to memory of 3012	4564	wscript.exe	86
PID 4564 wrote to memory of 3012	4564	wscript.exe	86
PID 3012 wrote to memory of 3452	3012	WScript.exe	87
PID 3012 wrote to memory of 3452	3012	WScript.exe	87
PID 4564 wrote to memory of 4540	4564	wscript.exe	90
PID 4564 wrote to memory of 4540	4564	wscript.exe	90
PID 3012 wrote to memory of 3164	3012	WScript.exe	89
PID 3012 wrote to memory of 3164	3012	WScript.exe	89
PID 3012 wrote to memory of 3164	3012	WScript.exe	89

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\9b0b93c3f2b8fee5d774436447b4990f.js
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\uLXRQKOPod.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:3540
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\9b0b93c3f2b8fee5d774436447b4990f.js"
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\uLXRQKOPod.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    PID:4732
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\LZURDX~1.JS"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ABjiMOejwE.js"
      4⤵
      Blocklisted process makes network request
      Drops startup file
      PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\originn.exe
      "C:\Users\Admin\AppData\Local\Temp\originn.exe"
      4⤵
      Executes dropped EXE
      PID:3164
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\wamafa.js"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    PID:4540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\originn.exe

Filesize
218KB

MD5
a82205bc5045698abee18cb9fd9bd3ab

SHA1
bfca05a5922518e408b5672c03d606e9f418c5a5

SHA256
46daff98e524432863b025426a9271f5e9a7f2df0e0b7e9246bb407e3521f5a2

SHA512
789a6c908ec671af3cbd2f4474e30f0df4e2523f3db0bc7f6119a17879fe2e8614d475e6d093c9094f2d88c985559c58cf8cbe836f53141153cc0fe5d5807e7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\originn.exe

Filesize
218KB

MD5
a82205bc5045698abee18cb9fd9bd3ab

SHA1
bfca05a5922518e408b5672c03d606e9f418c5a5

SHA256
46daff98e524432863b025426a9271f5e9a7f2df0e0b7e9246bb407e3521f5a2

SHA512
789a6c908ec671af3cbd2f4474e30f0df4e2523f3db0bc7f6119a17879fe2e8614d475e6d093c9094f2d88c985559c58cf8cbe836f53141153cc0fe5d5807e7b

Download Submit
C:\Users\Admin\AppData\Roaming\9b0b93c3f2b8fee5d774436447b4990f.js

Filesize
37KB

MD5
aa015cde14808315df0e50fc98fa8ca1

SHA1
499fd482cd7bad8d905564983f07e7ae822ea189

SHA256
75c5452fe55b5b42e88f7e22cf3d54665f639f721b55dbafa78b43c644f1b598

SHA512
08af4131b97d2177723bbc23981286f6f22e780db6d6f0e8894048fc971eb3cee3109b1daebe31107c2119d48ba0423625e6fbce180e6b9bc1fecdc56bba6278

Download Submit
C:\Users\Admin\AppData\Roaming\ABjiMOejwE.js

Filesize
5KB

MD5
942528fb942a1c7618904d06c736b0df

SHA1
3aac0579530eb3ca335ee947ec593e2e1eb18e24

SHA256
df961e75c9905fffc226bcabf4fbca090660680710610f4696d102d352078992

SHA512
6388302596f3c5fdd1ab85e07a34907328c21440541b870f351b3f1f381a23d6276a4950ae309810bf532e398dc3c450dc6212301cdd7e2efc0b944c41ba28d1

Download Submit
C:\Users\Admin\AppData\Roaming\LZURDX~1.JS

Filesize
399KB

MD5
0ba58a6dab7819f1885c4a6379dc8c8c

SHA1
277dc39d693403efdf8e4374cfbd15480e6da3da

SHA256
8ea7e9a5eb1baf49cc22c45b82bdec95186ad7c37d58eb71d5bccaba737e00ca

SHA512
e9ad76884c0d284ff5791061ef3bb959389587bf0dcdff63945dbc869f862a9ff969b6a3fe3b8223fb164bb548bb82347e8d73bed919c81a0fc3c5b3288f53d2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9b0b93c3f2b8fee5d774436447b4990f.js

Filesize
37KB

MD5
aa015cde14808315df0e50fc98fa8ca1

SHA1
499fd482cd7bad8d905564983f07e7ae822ea189

SHA256
75c5452fe55b5b42e88f7e22cf3d54665f639f721b55dbafa78b43c644f1b598

SHA512
08af4131b97d2177723bbc23981286f6f22e780db6d6f0e8894048fc971eb3cee3109b1daebe31107c2119d48ba0423625e6fbce180e6b9bc1fecdc56bba6278

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uLXRQKOPod.js

Filesize
5KB

MD5
4698d3d1682a4213ae3149ee009ca463

SHA1
c20830759b6f631fc774ee9f73df12de7e8269b2

SHA256
51143eeaa698bb5361d1b6759df8fd884f874d2058ee8da0b71e37231fe99b84

SHA512
32b0fc0e5687fa02e5f6e910fa469b62b360d063ff35511e512079d37ef64e4e7cbf7f28a53003c8b6be7ab4629424a62e1fb7d1e6b91e29d606499be07e9336

Download Submit
C:\Users\Admin\AppData\Roaming\uLXRQKOPod.js

Filesize
5KB

MD5
4698d3d1682a4213ae3149ee009ca463

SHA1
c20830759b6f631fc774ee9f73df12de7e8269b2

SHA256
51143eeaa698bb5361d1b6759df8fd884f874d2058ee8da0b71e37231fe99b84

SHA512
32b0fc0e5687fa02e5f6e910fa469b62b360d063ff35511e512079d37ef64e4e7cbf7f28a53003c8b6be7ab4629424a62e1fb7d1e6b91e29d606499be07e9336

Download Submit
C:\Users\Admin\AppData\Roaming\uLXRQKOPod.js

Filesize
5KB

MD5
4698d3d1682a4213ae3149ee009ca463

SHA1
c20830759b6f631fc774ee9f73df12de7e8269b2

SHA256
51143eeaa698bb5361d1b6759df8fd884f874d2058ee8da0b71e37231fe99b84

SHA512
32b0fc0e5687fa02e5f6e910fa469b62b360d063ff35511e512079d37ef64e4e7cbf7f28a53003c8b6be7ab4629424a62e1fb7d1e6b91e29d606499be07e9336

Download Submit
C:\Users\Admin\AppData\Roaming\wamafa.js

Filesize
5KB

MD5
5edd1cc5d54ee31317b857ebe6e7b4d3

SHA1
1e1fee969e9092f7a9769c20de8ae4943c227161

SHA256
1f2ccddc4d9634a8faf78f3c0df6e926cd8f145e21738f35f07b67abfc4c8eb8

SHA512
216ed3e514ef0562a5cb41eb3a3ca270b265bb5fb06fc3f08c105c90293364c9ba8801fe314e83cec7a0757b2fbf0d06dd84ec16879502b3005d32177a6cac9d

Download Submit
memory/3164-149-0x0000000000B80000-0x0000000000BBC000-memory.dmp

Filesize
240KB

Download
memory/3164-150-0x0000000005A60000-0x0000000006004000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads