Analysis
-
max time kernel
149s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
18-10-2023 16:11
General
-
Target
Ref-231017AF-Payment-Details.js
-
Size
7KB
-
MD5
e811c4c9c880e3fae8bfb0cd7be6a4f6
-
SHA1
b329fe66df345f51d229f5b76069a1f1263a1c2b
-
SHA256
4a41e0418949914320454262970d1c878a37b2c01b48a7e92047f536771bf6f9
-
SHA512
64ddaa45cddf959f07dac85ac412e169964f70150c02b32c1ff941791b2ce609a3d824d371b37e05bf7e7ec21b2658b7d462a9d9bfaa5a694c673aeefd335108
-
SSDEEP
48:6IDkWkpUJeT2nfw9LOABJCvs2LNL75q+tCqB5q04CXSR:8wm0JciBc0lo
Malware Config
Extracted
Protocol: ftp- Host:
ftp.martur.cl - Port:
21 - Username:
[email protected] - Password:
(57reRWWw5dj
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.martur.cl - Port:
21 - Username:
[email protected] - Password:
(57reRWWw5dj
Extracted
wshrat
http://chongmei33.publicvm.com:7045
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
-
WSHRAT payload 2 IoCs
-
Blocklisted process makes network request 31 IoCs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Script User-Agent 27 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Ref-231017AF-Payment-Details.js1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\NAKFZC.js"2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Output.js"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vOb.exe"C:\Users\Admin\AppData\Local\Temp\vOb.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command xHpF2m2TxzO3qr4FIuPswPaRZvbKhAgsHoUgVc5c1AMOAI4xiJqOjlkD3YO/6qULkSENmFl3GsolqcGGkZrBbaRXVu7YY+n3wiyv8wS+UHUpwhx/IX6ZerqvTzuOLuRdO08npei7HwfH2wKRuaecB8P/FVecfW9FoWjF1A6O/68O0qK192cnIhUcctWjx/GW8ULXo/Un0WwvyWYxGKqhFtUjf6hQETjLzO/F68/W3GXggNfn4E0tbsHcWJ4Qs9QeauMywyAB+V1+9Uw+hcoLBpcocrYAhSqf6iaaMKaTanR4JlGBlD4IjJQmV1gvQRYmjDXbZawN8IgwRgaI+xcKtFjiFVvuA6CawFF5jzi4mENimIA39OD54y/zMb7idEh4oTy+f+VDOiQ16HbDvRyX1gv6ar2K+vNdRpiEk+FL75Dwi1y2R1DSLLrnXH75cn9Sxxkx16fkjltmZNwZYnnZc0VCbJz5PE8snBKcKUEemoAvDwcgj8rVX1tuhqqeYXrhP1hn6oaUpa8dLV9GkxPvUPm2U2PxYjlaVQk75pkxpaspctI89cBy4lXgWn0XYPaK1+WjxY5j1F5jeSb75FxuowoTWUXfk8j1s2KbANCsBuN3nd5227aIGAKGm+1kHAm/4MePOuLnj7mVqVrGuW9smZZvnluk2n2p0v6RGPmD818= 'C:\Users\Admin\AppData\Local\Temp\vOb.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows Audio.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\vOb.exe"C:\Users\Admin\AppData\Local\Temp\vOb.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
706B
MD52ef5ef69dadb8865b3d5b58c956077b8
SHA1af2d869bac00685c745652bbd8b3fe82829a8998
SHA256363502eb2a4e53ba02d2d85412b901fcf8e06de221736bdffa949799ef3d21e3
SHA51266d4db5dd17d88e1d54ea0df3a7211a503dc4355de701259cefccc9f2e4e3ced9534b700099ffbb089a5a3acb082011c80b61801aa14aff76b379ce8f90d4fd3
-
Filesize
764KB
MD58d38022aafef200f061a873cad79fe61
SHA1536fb4fe64ce9695322eaca56ad895457acdfde8
SHA25615921f2949858a67b8f01ac048ceed3083774b664549ea455d12eb8748049961
SHA512e65acf7151e032df49a4f2bcd29dbcac0a3b1c2eb63f240bf556d603869ca5a73a61ba23aba924efb8fb764f212cceb9705c3ff8cdb635651ba9e10d2bb94060
-
Filesize
484KB
MD5183b67bb3bced4ef59e57cfbfff3d08e
SHA1f79fe87e3c5f331895db528dd7beef8b5477187a
SHA25633170390bddb29dc3b25b4301982f88451c1cdff4415f98050a470c7f6d31f32
SHA51221f2c5d01f493dc1d5f7c84c387b5cea5270f635ab154946a208977e8c9cc95b837d82230b74b307d0e20cabfabbf8a578b9b9be9260790d886426e358e0dabc
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
346KB
MD584c9943b3b720f2090e42202d733ff5b
SHA1da75a570bdceaa6eeb9beb3cf1a2a2a334265349
SHA2561fd86142972ca45a894e5bae8f464164d521694d7a65e3e28d59be74ba6d5166
SHA512aefc0c23ffc5b7d832e76eac265c403088b4ebbb120ceb718b753fda1b4292c9d3a05bfba303756fa25bed2e9090ac9f1925c232aa7cd443ebeb412f3dc88624
-
Filesize
346KB
MD584c9943b3b720f2090e42202d733ff5b
SHA1da75a570bdceaa6eeb9beb3cf1a2a2a334265349
SHA2561fd86142972ca45a894e5bae8f464164d521694d7a65e3e28d59be74ba6d5166
SHA512aefc0c23ffc5b7d832e76eac265c403088b4ebbb120ceb718b753fda1b4292c9d3a05bfba303756fa25bed2e9090ac9f1925c232aa7cd443ebeb412f3dc88624
-
Filesize
346KB
MD584c9943b3b720f2090e42202d733ff5b
SHA1da75a570bdceaa6eeb9beb3cf1a2a2a334265349
SHA2561fd86142972ca45a894e5bae8f464164d521694d7a65e3e28d59be74ba6d5166
SHA512aefc0c23ffc5b7d832e76eac265c403088b4ebbb120ceb718b753fda1b4292c9d3a05bfba303756fa25bed2e9090ac9f1925c232aa7cd443ebeb412f3dc88624
-
Filesize
346KB
MD584c9943b3b720f2090e42202d733ff5b
SHA1da75a570bdceaa6eeb9beb3cf1a2a2a334265349
SHA2561fd86142972ca45a894e5bae8f464164d521694d7a65e3e28d59be74ba6d5166
SHA512aefc0c23ffc5b7d832e76eac265c403088b4ebbb120ceb718b753fda1b4292c9d3a05bfba303756fa25bed2e9090ac9f1925c232aa7cd443ebeb412f3dc88624
-
Filesize
764KB
MD58d38022aafef200f061a873cad79fe61
SHA1536fb4fe64ce9695322eaca56ad895457acdfde8
SHA25615921f2949858a67b8f01ac048ceed3083774b664549ea455d12eb8748049961
SHA512e65acf7151e032df49a4f2bcd29dbcac0a3b1c2eb63f240bf556d603869ca5a73a61ba23aba924efb8fb764f212cceb9705c3ff8cdb635651ba9e10d2bb94060
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
368KB
-
Filesize
336KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
320KB
-
Filesize
7.7MB
-
Filesize
264KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
200KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
6.2MB
-
Filesize
652KB
-
Filesize
408KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
600KB
-
Filesize
68KB
-
Filesize
216KB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
64KB