Analysis

  • max time kernel
    1802s
  • max time network
    1137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/10/2023, 11:23

General

  • Target

    sigma/CheatoSpoofer.exe

  • Size

    31.7MB

  • MD5

    e089f7eb07b684126ffa1d105d675f4e

  • SHA1

    688c59394b08c11f42f0d91a7c21d46cf4173d97

  • SHA256

    c5a5752a69f7b8c3e6b0ef34befb3baa0ee237eec74de7f9c6eba42e19850b18

  • SHA512

    b4a44cf5d100700d5a302d3873c0781b82420df0817f94a2dca20eabe945197e5ed3c47a8e9b42cee4fdb8b80efd656b4b17c81cd121ac8368843ceb0a74ccf7

  • SSDEEP

    786432:AF6hldW39X3/s+3/Du5n10x5v2LawEYcnd:lrCRvLbu7AfhYcd

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Obfuscated with Agile.Net obfuscator 24 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sigma\CheatoSpoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\sigma\CheatoSpoofer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1248
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}
    1⤵
      PID:4008
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies registry class
      PID:3296
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4120
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
        • Checks SCSI registry key(s)
        • Checks processor information in registry
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1224
      • C:\Users\Admin\AppData\Local\Temp\sigma\CheatoSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\sigma\CheatoSpoofer.exe"
        1⤵
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Enumerates system info in registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4528

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Sentry\9588CF3ABD7EF58A0A76612B90AB4AC3D3B45E66\.installation

        Filesize

        36B

        MD5

        09eb424ba95dc8c3df5bc17d4cc6a823

        SHA1

        ed9ab62320b1dca877852e841d77457d8adace53

        SHA256

        d75e9a1253cc39c6511f70fad94f575daf8d3fb3bdf2caf9eba6531295a2a8ec

        SHA512

        f970dbde017987e7f3c3d250280cd2406a5f71fb5ff14beabf4e15efc4ad64b67ab773996d9e200a9e27db75733d37e8530ce070b963dc8cf104f16c46b39d9f

      • C:\Users\Admin\AppData\Local\Temp\Costura\1E86214F0E241413D5D58494E90760E9\64\user64.dll

        Filesize

        226KB

        MD5

        519f34494d7484d85ecfad85f23bac05

        SHA1

        8f1be6ce8501ca1def6d02fde760d48169677bc5

        SHA256

        1f7a51dd23092e70b8e323c86229de242568ffc7d27271aaf88d051662ba32f9

        SHA512

        d9e34321e6d32c5da664200bb5609bb2d19fcd44d36f8109e7ad2e44b5dbf1cb46e3d5b8c529d90f051e6f4cc2891301f213c9d3faac8fc4a0f3b0b8d9a3f81b

      • C:\Users\Admin\AppData\Local\Temp\Costura\1E86214F0E241413D5D58494E90760E9\64\user64.dll

        Filesize

        226KB

        MD5

        519f34494d7484d85ecfad85f23bac05

        SHA1

        8f1be6ce8501ca1def6d02fde760d48169677bc5

        SHA256

        1f7a51dd23092e70b8e323c86229de242568ffc7d27271aaf88d051662ba32f9

        SHA512

        d9e34321e6d32c5da664200bb5609bb2d19fcd44d36f8109e7ad2e44b5dbf1cb46e3d5b8c529d90f051e6f4cc2891301f213c9d3faac8fc4a0f3b0b8d9a3f81b

      • C:\Users\Admin\AppData\Local\Temp\Costura\1E86214F0E241413D5D58494E90760E9\64\user64.dll

        Filesize

        226KB

        MD5

        519f34494d7484d85ecfad85f23bac05

        SHA1

        8f1be6ce8501ca1def6d02fde760d48169677bc5

        SHA256

        1f7a51dd23092e70b8e323c86229de242568ffc7d27271aaf88d051662ba32f9

        SHA512

        d9e34321e6d32c5da664200bb5609bb2d19fcd44d36f8109e7ad2e44b5dbf1cb46e3d5b8c529d90f051e6f4cc2891301f213c9d3faac8fc4a0f3b0b8d9a3f81b

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iqe3ct2z.2is.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • memory/1224-119-0x00000233C6980000-0x00000233C6981000-memory.dmp

        Filesize

        4KB

      • memory/1224-120-0x00000233C6980000-0x00000233C6981000-memory.dmp

        Filesize

        4KB

      • memory/1224-118-0x00000233C6980000-0x00000233C6981000-memory.dmp

        Filesize

        4KB

      • memory/1224-130-0x00000233C6980000-0x00000233C6981000-memory.dmp

        Filesize

        4KB

      • memory/1224-129-0x00000233C6980000-0x00000233C6981000-memory.dmp

        Filesize

        4KB

      • memory/1224-128-0x00000233C6980000-0x00000233C6981000-memory.dmp

        Filesize

        4KB

      • memory/1224-127-0x00000233C6980000-0x00000233C6981000-memory.dmp

        Filesize

        4KB

      • memory/1224-126-0x00000233C6980000-0x00000233C6981000-memory.dmp

        Filesize

        4KB

      • memory/1224-124-0x00000233C6980000-0x00000233C6981000-memory.dmp

        Filesize

        4KB

      • memory/1224-125-0x00000233C6980000-0x00000233C6981000-memory.dmp

        Filesize

        4KB

      • memory/1248-61-0x000001E0D33A0000-0x000001E0D34B5000-memory.dmp

        Filesize

        1.1MB

      • memory/1248-69-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/1248-12-0x000001E0B8CB0000-0x000001E0B8CB1000-memory.dmp

        Filesize

        4KB

      • memory/1248-14-0x000001E0B8CB0000-0x000001E0B8CB1000-memory.dmp

        Filesize

        4KB

      • memory/1248-13-0x00007FFDC6E90000-0x00007FFDC7951000-memory.dmp

        Filesize

        10.8MB

      • memory/1248-15-0x000001E0BA150000-0x000001E0BA18E000-memory.dmp

        Filesize

        248KB

      • memory/1248-20-0x000001E0BA190000-0x000001E0BA1C8000-memory.dmp

        Filesize

        224KB

      • memory/1248-21-0x000001E0D2A20000-0x000001E0D2AB4000-memory.dmp

        Filesize

        592KB

      • memory/1248-22-0x000001E0B8D60000-0x000001E0B8D68000-memory.dmp

        Filesize

        32KB

      • memory/1248-24-0x000001E0B9CB0000-0x000001E0B9CB8000-memory.dmp

        Filesize

        32KB

      • memory/1248-25-0x000001E0B8D80000-0x000001E0B8D88000-memory.dmp

        Filesize

        32KB

      • memory/1248-26-0x000001E0B9CA0000-0x000001E0B9CAA000-memory.dmp

        Filesize

        40KB

      • memory/1248-27-0x000001E0B9CC0000-0x000001E0B9CC8000-memory.dmp

        Filesize

        32KB

      • memory/1248-28-0x000001E0B9CE0000-0x000001E0B9CEA000-memory.dmp

        Filesize

        40KB

      • memory/1248-23-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/1248-29-0x000001E0D2810000-0x000001E0D2820000-memory.dmp

        Filesize

        64KB

      • memory/1248-30-0x000001E0D2810000-0x000001E0D2820000-memory.dmp

        Filesize

        64KB

      • memory/1248-32-0x000001E0D2B00000-0x000001E0D2B26000-memory.dmp

        Filesize

        152KB

      • memory/1248-31-0x000001E0B9CF0000-0x000001E0B9D04000-memory.dmp

        Filesize

        80KB

      • memory/1248-34-0x000001E0BA370000-0x000001E0BA378000-memory.dmp

        Filesize

        32KB

      • memory/1248-33-0x000001E0BA360000-0x000001E0BA368000-memory.dmp

        Filesize

        32KB

      • memory/1248-37-0x000001E0D2810000-0x000001E0D2820000-memory.dmp

        Filesize

        64KB

      • memory/1248-38-0x000001E0D2B50000-0x000001E0D2BAA000-memory.dmp

        Filesize

        360KB

      • memory/1248-36-0x000001E0D2B30000-0x000001E0D2B54000-memory.dmp

        Filesize

        144KB

      • memory/1248-39-0x000001E0D2BB0000-0x000001E0D2BBC000-memory.dmp

        Filesize

        48KB

      • memory/1248-40-0x000001E0D2BC0000-0x000001E0D2BD4000-memory.dmp

        Filesize

        80KB

      • memory/1248-41-0x000001E0B8CB0000-0x000001E0B8CB1000-memory.dmp

        Filesize

        4KB

      • memory/1248-42-0x000001E0D2BE0000-0x000001E0D2C28000-memory.dmp

        Filesize

        288KB

      • memory/1248-44-0x000001E0D2CE0000-0x000001E0D2CEE000-memory.dmp

        Filesize

        56KB

      • memory/1248-43-0x000001E0D2C30000-0x000001E0D2CE2000-memory.dmp

        Filesize

        712KB

      • memory/1248-45-0x000001E0D2E30000-0x000001E0D2E4A000-memory.dmp

        Filesize

        104KB

      • memory/1248-46-0x000001E0D2E70000-0x000001E0D2E8A000-memory.dmp

        Filesize

        104KB

      • memory/1248-47-0x000001E0D2EE0000-0x000001E0D2F02000-memory.dmp

        Filesize

        136KB

      • memory/1248-48-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/1248-49-0x000001E0D2810000-0x000001E0D2820000-memory.dmp

        Filesize

        64KB

      • memory/1248-50-0x000001E0D2810000-0x000001E0D2820000-memory.dmp

        Filesize

        64KB

      • memory/1248-51-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/1248-10-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/1248-62-0x000001E0D2810000-0x000001E0D2820000-memory.dmp

        Filesize

        64KB

      • memory/1248-63-0x000001E0D2F50000-0x000001E0D2F82000-memory.dmp

        Filesize

        200KB

      • memory/1248-64-0x000001E0D2F80000-0x000001E0D2FF6000-memory.dmp

        Filesize

        472KB

      • memory/1248-65-0x000001E0D3010000-0x000001E0D3028000-memory.dmp

        Filesize

        96KB

      • memory/1248-66-0x000001E0D3030000-0x000001E0D3062000-memory.dmp

        Filesize

        200KB

      • memory/1248-67-0x000001E0D2F40000-0x000001E0D2F48000-memory.dmp

        Filesize

        32KB

      • memory/1248-68-0x000001E0D3060000-0x000001E0D306A000-memory.dmp

        Filesize

        40KB

      • memory/1248-11-0x000001E0D2810000-0x000001E0D2820000-memory.dmp

        Filesize

        64KB

      • memory/1248-70-0x000001E0D33A0000-0x000001E0D34B5000-memory.dmp

        Filesize

        1.1MB

      • memory/1248-72-0x000001E0D3260000-0x000001E0D3324000-memory.dmp

        Filesize

        784KB

      • memory/1248-73-0x000001E0D34C0000-0x000001E0D36B6000-memory.dmp

        Filesize

        2.0MB

      • memory/1248-71-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/1248-75-0x000001E0D2810000-0x000001E0D2820000-memory.dmp

        Filesize

        64KB

      • memory/1248-76-0x000001E0D3320000-0x000001E0D339E000-memory.dmp

        Filesize

        504KB

      • memory/1248-77-0x000001E0D4450000-0x000001E0D459E000-memory.dmp

        Filesize

        1.3MB

      • memory/1248-78-0x000001E0D2ED0000-0x000001E0D2EE4000-memory.dmp

        Filesize

        80KB

      • memory/1248-79-0x000001E0D46A0000-0x000001E0D486E000-memory.dmp

        Filesize

        1.8MB

      • memory/1248-80-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/1248-81-0x000001E0D33A0000-0x000001E0D34B5000-memory.dmp

        Filesize

        1.1MB

      • memory/1248-92-0x000001E0D2810000-0x000001E0D2820000-memory.dmp

        Filesize

        64KB

      • memory/1248-93-0x000001E0D2810000-0x000001E0D2820000-memory.dmp

        Filesize

        64KB

      • memory/1248-94-0x000001E0D6A70000-0x000001E0D6B70000-memory.dmp

        Filesize

        1024KB

      • memory/1248-95-0x000001E0D6B90000-0x000001E0D6B9E000-memory.dmp

        Filesize

        56KB

      • memory/1248-96-0x000001E0D6BB0000-0x000001E0D6BB8000-memory.dmp

        Filesize

        32KB

      • memory/1248-97-0x000001E0D6BC0000-0x000001E0D6BDA000-memory.dmp

        Filesize

        104KB

      • memory/1248-98-0x000001E0D7010000-0x000001E0D7016000-memory.dmp

        Filesize

        24KB

      • memory/1248-99-0x000001E0D7020000-0x000001E0D702A000-memory.dmp

        Filesize

        40KB

      • memory/1248-100-0x000001E0D7030000-0x000001E0D7036000-memory.dmp

        Filesize

        24KB

      • memory/1248-101-0x000001E0D7040000-0x000001E0D7048000-memory.dmp

        Filesize

        32KB

      • memory/1248-102-0x000001E0D7050000-0x000001E0D705A000-memory.dmp

        Filesize

        40KB

      • memory/1248-9-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/1248-8-0x00007FF47ABE0000-0x00007FF47AFB1000-memory.dmp

        Filesize

        3.8MB

      • memory/1248-7-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/1248-6-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/1248-5-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/1248-4-0x00007FFDC6E90000-0x00007FFDC7951000-memory.dmp

        Filesize

        10.8MB

      • memory/1248-3-0x00007FFDE4B20000-0x00007FFDE4B30000-memory.dmp

        Filesize

        64KB

      • memory/1248-112-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/1248-114-0x000001E0D33A0000-0x000001E0D34B5000-memory.dmp

        Filesize

        1.1MB

      • memory/1248-113-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/1248-0-0x00007FF47ABE0000-0x00007FF47AFB1000-memory.dmp

        Filesize

        3.8MB

      • memory/1248-1-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/1248-2-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/4528-139-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/4528-140-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/4528-138-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/4528-134-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/4528-133-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/4528-164-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/4528-165-0x000002341AC20000-0x000002341AD35000-memory.dmp

        Filesize

        1.1MB

      • memory/4528-170-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/4528-171-0x000002341AC20000-0x000002341AD35000-memory.dmp

        Filesize

        1.1MB

      • memory/4528-176-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB

      • memory/4528-177-0x0000000000700000-0x00000000050B4000-memory.dmp

        Filesize

        73.7MB