Analysis
- max time kernel
146s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
- submitted
23/02/2024, 15:27
General
- Target specification sheet.exe
- Size 686KB
- Sample240223-svq3mscb27
- SHA256 e68a0da390baf3802baa117bce98b4b3bcbd4f0d0f1355df483d1c5366206921
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.itresinc.com
-
Port
587
-
Username
-
Password
MT]ANFjWzKTA
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\specification sheet.exe"C:\Users\Admin\AppData\Local\Temp\specification sheet.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\specification sheet.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iDddpGmSjINlvS.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iDddpGmSjINlvS" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4FC1.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 20283⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2796 -ip 27961⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_yi4v0rmd.2e5.ps1
tmp4FC1.tmp
memory/2240-10-0x0000000005BB0000-0x0000000005BC2000-memory.dmp
memory/2240-4-0x00000000051D0000-0x00000000051E0000-memory.dmp
memory/2240-6-0x00000000051E0000-0x000000000527C000-memory.dmp
memory/2240-7-0x0000000005B70000-0x0000000005B90000-memory.dmp
memory/2240-8-0x0000000074D40000-0x00000000754F0000-memory.dmp
memory/2240-9-0x0000000005BA0000-0x0000000005BAE000-memory.dmp
memory/2240-1-0x0000000074D40000-0x00000000754F0000-memory.dmp
memory/2240-11-0x0000000006AA0000-0x0000000006B22000-memory.dmp
memory/2240-12-0x00000000051D0000-0x00000000051E0000-memory.dmp
memory/2240-5-0x0000000005100000-0x000000000510A000-memory.dmp
memory/2240-3-0x0000000004F60000-0x0000000004FF2000-memory.dmp
memory/2240-32-0x0000000074D40000-0x00000000754F0000-memory.dmp
memory/2240-0-0x00000000004F0000-0x00000000005A2000-memory.dmp
memory/2240-2-0x0000000005470000-0x0000000005A14000-memory.dmp
memory/2796-90-0x0000000074D40000-0x00000000754F0000-memory.dmp
memory/2796-33-0x0000000005450000-0x0000000005460000-memory.dmp
memory/2796-92-0x0000000074D40000-0x00000000754F0000-memory.dmp
memory/2796-26-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2796-29-0x0000000074D40000-0x00000000754F0000-memory.dmp
memory/4388-48-0x0000000006370000-0x00000000066C4000-memory.dmp
memory/4388-82-0x0000000007C70000-0x0000000007C8A000-memory.dmp
memory/4388-102-0x0000000074D40000-0x00000000754F0000-memory.dmp
memory/4388-27-0x0000000005850000-0x0000000005872000-memory.dmp
memory/4388-18-0x0000000074D40000-0x00000000754F0000-memory.dmp
memory/4388-23-0x0000000005420000-0x0000000005430000-memory.dmp
memory/4388-96-0x0000000005420000-0x0000000005430000-memory.dmp
memory/4388-94-0x0000000007FB0000-0x0000000007FCA000-memory.dmp
memory/4388-53-0x0000000006920000-0x000000000693E000-memory.dmp
memory/4388-54-0x00000000069C0000-0x0000000006A0C000-memory.dmp
memory/4388-55-0x0000000005420000-0x0000000005430000-memory.dmp
memory/4388-56-0x0000000006EE0000-0x0000000006F12000-memory.dmp
memory/4388-20-0x0000000005420000-0x0000000005430000-memory.dmp
memory/4388-57-0x00000000755A0000-0x00000000755EC000-memory.dmp
memory/4388-19-0x0000000005390000-0x00000000053C6000-memory.dmp
memory/4388-78-0x0000000006F60000-0x0000000006F7E000-memory.dmp
memory/4388-89-0x0000000007E70000-0x0000000007E81000-memory.dmp
memory/4388-80-0x0000000007920000-0x00000000079C3000-memory.dmp
memory/4388-88-0x0000000007F10000-0x0000000007FA6000-memory.dmp
memory/4388-86-0x0000000005420000-0x0000000005430000-memory.dmp
memory/4388-83-0x0000000074D40000-0x00000000754F0000-memory.dmp
memory/4388-85-0x0000000007CE0000-0x0000000007CEA000-memory.dmp
memory/4964-93-0x0000000007CD0000-0x0000000007CE4000-memory.dmp
memory/4964-21-0x0000000002EF0000-0x0000000002F00000-memory.dmp
memory/4964-87-0x0000000002EF0000-0x0000000002F00000-memory.dmp
memory/4964-81-0x00000000080F0000-0x000000000876A000-memory.dmp
memory/4964-77-0x000000007F1F0000-0x000000007F200000-memory.dmp
memory/4964-59-0x0000000074D40000-0x00000000754F0000-memory.dmp
memory/4964-28-0x0000000005810000-0x0000000005876000-memory.dmp
memory/4964-91-0x0000000007CC0000-0x0000000007CCE000-memory.dmp
memory/4964-84-0x0000000002EF0000-0x0000000002F00000-memory.dmp
memory/4964-58-0x00000000755A0000-0x00000000755EC000-memory.dmp
memory/4964-95-0x0000000007D10000-0x0000000007D18000-memory.dmp
memory/4964-22-0x0000000002EF0000-0x0000000002F00000-memory.dmp
memory/4964-24-0x0000000005970000-0x0000000005F98000-memory.dmp
memory/4964-17-0x0000000074D40000-0x00000000754F0000-memory.dmp
memory/4964-31-0x0000000006010000-0x0000000006076000-memory.dmp
memory/4964-103-0x0000000074D40000-0x00000000754F0000-memory.dmp