Analysis
- max time kernel
92s - max time network
121s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
31/01/2024, 11:06
General
- Target FedEx_23241747012.exe
- Size 732KB
- Sample240131-m7fjsaagb5
- SHA256 4d290f4b37dbfff6a41b0fbe03f1f8af96ac78b86f40b726090f48e86c854834
Malware Config
Extracted
-
Protocol
smtp
-
Host
smtp.crane-eletronics.com
-
Port
587
-
Username
-
Password
!rRcoXv3
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.crane-eletronics.com
-
Port
587
-
Username
-
Password
!rRcoXv3
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FedEx_23241747012.exe"C:\Users\Admin\AppData\Local\Temp\FedEx_23241747012.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FedEx_23241747012.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_x50jvrsf.ves.ps1
memory/1252-12-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1252-65-0x00000000063C0000-0x0000000006410000-memory.dmp
memory/1252-66-0x0000000074650000-0x0000000074E00000-memory.dmp
memory/1252-22-0x0000000005400000-0x0000000005410000-memory.dmp
memory/1252-20-0x00000000054E0000-0x0000000005546000-memory.dmp
memory/1252-67-0x0000000005400000-0x0000000005410000-memory.dmp
memory/1252-16-0x0000000074650000-0x0000000074E00000-memory.dmp
memory/2116-5-0x0000000005340000-0x000000000534A000-memory.dmp
memory/2116-9-0x00000000091A0000-0x000000000923C000-memory.dmp
memory/2116-10-0x0000000074650000-0x0000000074E00000-memory.dmp
memory/2116-11-0x0000000005460000-0x0000000005470000-memory.dmp
memory/2116-8-0x0000000006B40000-0x0000000006BC4000-memory.dmp
memory/2116-7-0x0000000006530000-0x0000000006544000-memory.dmp
memory/2116-15-0x0000000074650000-0x0000000074E00000-memory.dmp
memory/2116-6-0x00000000058F0000-0x000000000590C000-memory.dmp
memory/2116-4-0x0000000005460000-0x0000000005470000-memory.dmp
memory/2116-3-0x0000000005290000-0x0000000005322000-memory.dmp
memory/2116-2-0x0000000005910000-0x0000000005EB4000-memory.dmp
memory/2116-1-0x0000000074650000-0x0000000074E00000-memory.dmp
memory/2116-0-0x0000000000850000-0x000000000090E000-memory.dmp
memory/4100-18-0x0000000005610000-0x0000000005C38000-memory.dmp
memory/4100-56-0x0000000007B20000-0x0000000007BB6000-memory.dmp
memory/4100-17-0x0000000074650000-0x0000000074E00000-memory.dmp
memory/4100-23-0x0000000005590000-0x00000000055B2000-memory.dmp
memory/4100-36-0x00000000065C0000-0x000000000660C000-memory.dmp
memory/4100-35-0x0000000006570000-0x000000000658E000-memory.dmp
memory/4100-14-0x0000000002C40000-0x0000000002C76000-memory.dmp
memory/4100-52-0x0000000007560000-0x0000000007603000-memory.dmp
memory/4100-51-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/4100-54-0x00000000078A0000-0x00000000078BA000-memory.dmp
memory/4100-53-0x0000000007EE0000-0x000000000855A000-memory.dmp
memory/4100-55-0x0000000007910000-0x000000000791A000-memory.dmp
memory/4100-50-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/4100-34-0x0000000006190000-0x00000000064E4000-memory.dmp
memory/4100-49-0x0000000006B40000-0x0000000006B5E000-memory.dmp
memory/4100-57-0x0000000007AA0000-0x0000000007AB1000-memory.dmp
memory/4100-39-0x00000000702D0000-0x000000007031C000-memory.dmp
memory/4100-38-0x0000000007520000-0x0000000007552000-memory.dmp
memory/4100-37-0x000000007F6E0000-0x000000007F6F0000-memory.dmp
memory/4100-59-0x0000000007AE0000-0x0000000007AF4000-memory.dmp
memory/4100-60-0x0000000007BE0000-0x0000000007BFA000-memory.dmp
memory/4100-61-0x0000000007BC0000-0x0000000007BC8000-memory.dmp
memory/4100-58-0x0000000007AD0000-0x0000000007ADE000-memory.dmp
memory/4100-64-0x0000000074650000-0x0000000074E00000-memory.dmp
memory/4100-24-0x0000000005DB0000-0x0000000005E16000-memory.dmp
memory/4100-21-0x0000000002C00000-0x0000000002C10000-memory.dmp
memory/4100-19-0x0000000002C00000-0x0000000002C10000-memory.dmp