Analysis
- max time kernel
172s - max time network
180s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
07/03/2024, 14:40
General
- Target hPDm1zqGikzdtvg.exe
- Size 762KB
- Sample240307-r1vscade52
- SHA256 22fdc4147f762783c87c265e7e798ca7ac6200faedda883cab3fe01d2b89ff9e
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
sg2plcpnl0128.prod.sin2.secureserver.net
-
Port
587
-
Username
-
Password
]EMe[F7b^j@[
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\hPDm1zqGikzdtvg.exe"C:\Users\Admin\AppData\Local\Temp\hPDm1zqGikzdtvg.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\hPDm1zqGikzdtvg.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vlqHeXUwINL.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vlqHeXUwINL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp24D9.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_aqdy0s11.ej2.ps1
tmp24D9.tmp
memory/1628-49-0x0000000005250000-0x0000000005260000-memory.dmp
memory/1628-97-0x0000000005250000-0x0000000005260000-memory.dmp
memory/1628-29-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1628-95-0x00000000066D0000-0x0000000006720000-memory.dmp
memory/1628-96-0x0000000074400000-0x0000000074BB0000-memory.dmp
memory/1628-46-0x0000000074400000-0x0000000074BB0000-memory.dmp
memory/2072-0-0x0000000074400000-0x0000000074BB0000-memory.dmp
memory/2072-15-0x0000000074400000-0x0000000074BB0000-memory.dmp
memory/2072-10-0x0000000006B50000-0x0000000006BEC000-memory.dmp
memory/2072-9-0x00000000068C0000-0x0000000006942000-memory.dmp
memory/2072-8-0x0000000005AF0000-0x0000000005AFE000-memory.dmp
memory/2072-7-0x0000000005AE0000-0x0000000005AEA000-memory.dmp
memory/2072-1-0x0000000000A30000-0x0000000000AF4000-memory.dmp
memory/2072-2-0x0000000005B00000-0x00000000060A4000-memory.dmp
memory/2072-4-0x0000000005500000-0x0000000005510000-memory.dmp
memory/2072-3-0x0000000005550000-0x00000000055E2000-memory.dmp
memory/2072-6-0x0000000005AA0000-0x0000000005AB4000-memory.dmp
memory/2072-5-0x00000000054F0000-0x00000000054FA000-memory.dmp
memory/2072-48-0x0000000074400000-0x0000000074BB0000-memory.dmp
memory/4284-94-0x0000000074400000-0x0000000074BB0000-memory.dmp
memory/4284-47-0x0000000005940000-0x0000000005C94000-memory.dmp
memory/4284-36-0x00000000057D0000-0x0000000005836000-memory.dmp
memory/4284-21-0x0000000074400000-0x0000000074BB0000-memory.dmp
memory/4284-80-0x0000000007160000-0x000000000717A000-memory.dmp
memory/4284-50-0x0000000005E50000-0x0000000005E6E000-memory.dmp
memory/4284-51-0x0000000005EA0000-0x0000000005EEC000-memory.dmp
memory/4284-52-0x0000000002530000-0x0000000002540000-memory.dmp
memory/4284-19-0x0000000002530000-0x0000000002540000-memory.dmp
memory/4284-86-0x00000000074A0000-0x00000000074BA000-memory.dmp
memory/4284-55-0x000000007F960000-0x000000007F970000-memory.dmp
memory/4284-84-0x0000000007390000-0x000000000739E000-memory.dmp
memory/4284-56-0x0000000006420000-0x0000000006452000-memory.dmp
memory/4284-82-0x00000000073E0000-0x0000000007476000-memory.dmp
memory/4284-67-0x0000000070BF0000-0x0000000070C3C000-memory.dmp
memory/4908-17-0x0000000074400000-0x0000000074BB0000-memory.dmp
memory/4908-79-0x0000000007E10000-0x000000000848A000-memory.dmp
memory/4908-78-0x00000000076B0000-0x0000000007753000-memory.dmp
memory/4908-81-0x0000000007830000-0x000000000783A000-memory.dmp
memory/4908-68-0x0000000006A70000-0x0000000006A8E000-memory.dmp
memory/4908-83-0x00000000079C0000-0x00000000079D1000-memory.dmp
memory/4908-57-0x0000000070BF0000-0x0000000070C3C000-memory.dmp
memory/4908-85-0x0000000007A00000-0x0000000007A14000-memory.dmp
memory/4908-54-0x000000007FD50000-0x000000007FD60000-memory.dmp
memory/4908-87-0x0000000007AE0000-0x0000000007AE8000-memory.dmp
memory/4908-53-0x0000000002D70000-0x0000000002D80000-memory.dmp
memory/4908-93-0x0000000074400000-0x0000000074BB0000-memory.dmp
memory/4908-23-0x0000000005690000-0x00000000056B2000-memory.dmp
memory/4908-35-0x0000000005DF0000-0x0000000005E56000-memory.dmp
memory/4908-20-0x0000000005750000-0x0000000005D78000-memory.dmp
memory/4908-18-0x0000000002D70000-0x0000000002D80000-memory.dmp
memory/4908-16-0x0000000002B20000-0x0000000002B56000-memory.dmp