Analysis
- max time kernel
115s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
- submitted
22/02/2024, 05:42
General
- Target 23b02a697196412dc72b191d239a55d791a819e8aea8a1ed636f2a8182c834d1.exe
- Size 706KB
- Sample240222-gd2x2adb79
- SHA256 23b02a697196412dc72b191d239a55d791a819e8aea8a1ed636f2a8182c834d1
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.wasstech.com
-
Port
587
-
Username
-
Password
Sunray2700@@
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
- Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
- Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
- Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\23b02a697196412dc72b191d239a55d791a819e8aea8a1ed636f2a8182c834d1.exe"C:\Users\Admin\AppData\Local\Temp\23b02a697196412dc72b191d239a55d791a819e8aea8a1ed636f2a8182c834d1.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\23b02a697196412dc72b191d239a55d791a819e8aea8a1ed636f2a8182c834d1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QUKkfGwFzUQSB.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QUKkfGwFzUQSB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7EC5.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_h5gqpqdh.14f.ps1
tmp7EC5.tmp
memory/2132-81-0x0000000007AF0000-0x0000000007B0A000-memory.dmp
memory/2132-38-0x0000000006360000-0x00000000066B4000-memory.dmp
memory/2132-93-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/2132-87-0x0000000007E30000-0x0000000007E4A000-memory.dmp
memory/2132-85-0x0000000007D20000-0x0000000007D2E000-memory.dmp
memory/2132-84-0x0000000007CF0000-0x0000000007D01000-memory.dmp
memory/2132-83-0x0000000007D70000-0x0000000007E06000-memory.dmp
memory/2132-82-0x0000000007B60000-0x0000000007B6A000-memory.dmp
memory/2132-16-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/2132-15-0x0000000002EA0000-0x0000000002ED6000-memory.dmp
memory/2132-18-0x0000000005A70000-0x0000000006098000-memory.dmp
memory/2132-19-0x0000000005430000-0x0000000005440000-memory.dmp
memory/2132-57-0x0000000074CD0000-0x0000000074D1C000-memory.dmp
memory/2132-77-0x0000000005430000-0x0000000005440000-memory.dmp
memory/2132-55-0x000000007F7E0000-0x000000007F7F0000-memory.dmp
memory/2132-54-0x0000000006D30000-0x0000000006D62000-memory.dmp
memory/2132-24-0x00000000058F0000-0x0000000005912000-memory.dmp
memory/2132-17-0x0000000005430000-0x0000000005440000-memory.dmp
memory/2592-80-0x0000000008260000-0x00000000088DA000-memory.dmp
memory/2592-20-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/2592-92-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/2592-27-0x0000000006250000-0x00000000062B6000-memory.dmp
memory/2592-88-0x0000000007F30000-0x0000000007F38000-memory.dmp
memory/2592-23-0x0000000003090000-0x00000000030A0000-memory.dmp
memory/2592-79-0x0000000007910000-0x00000000079B3000-memory.dmp
memory/2592-86-0x0000000007E50000-0x0000000007E64000-memory.dmp
memory/2592-33-0x00000000062C0000-0x0000000006326000-memory.dmp
memory/2592-52-0x00000000067F0000-0x000000000680E000-memory.dmp
memory/2592-53-0x0000000006990000-0x00000000069DC000-memory.dmp
memory/2592-56-0x0000000074CD0000-0x0000000074D1C000-memory.dmp
memory/2592-22-0x0000000003090000-0x00000000030A0000-memory.dmp
memory/2592-68-0x0000000006EC0000-0x0000000006EDE000-memory.dmp
memory/2592-58-0x000000007FB20000-0x000000007FB30000-memory.dmp
memory/3284-51-0x0000000005610000-0x0000000005620000-memory.dmp
memory/3284-39-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/3284-25-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3284-96-0x0000000005610000-0x0000000005620000-memory.dmp
memory/3284-95-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/3284-94-0x0000000006AF0000-0x0000000006B40000-memory.dmp
memory/5048-26-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/5048-9-0x0000000006F30000-0x0000000006FB2000-memory.dmp
memory/5048-8-0x0000000005F40000-0x0000000005F52000-memory.dmp
memory/5048-7-0x0000000005D60000-0x0000000005D6E000-memory.dmp
memory/5048-41-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/5048-6-0x0000000005D80000-0x0000000005DA0000-memory.dmp
memory/5048-2-0x0000000005F70000-0x0000000006514000-memory.dmp
memory/5048-10-0x00000000099C0000-0x0000000009A5C000-memory.dmp
memory/5048-5-0x00000000059A0000-0x00000000059AA000-memory.dmp
memory/5048-0-0x0000000000EF0000-0x0000000000FA6000-memory.dmp
memory/5048-3-0x00000000059C0000-0x0000000005A52000-memory.dmp
memory/5048-1-0x0000000074470000-0x0000000074C20000-memory.dmp
memory/5048-4-0x0000000005C50000-0x0000000005C60000-memory.dmp