Analysis
- max time kernel
151s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
20/03/2024, 13:13
General
- Target SwiftCopy$2498799.exe
- Size 651KB
- Sample240320-qf33jshc39
- SHA256 badaf9c6f71a7c03ecd0e08bb38e428d3d475625b27454d8fbc13796eba13e1a
Malware Config
Extracted
-
Protocol
smtp
-
Host
webmail.pale.rs.ba
-
Port
587
-
Username
-
Password
chinonso123456789
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
webmail.pale.rs.ba
-
Port
587
-
Username
-
Password
chinonso123456789
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SwiftCopy$2498799.exe"C:\Users\Admin\AppData\Local\Temp\SwiftCopy$2498799.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SwiftCopy$2498799.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OuRvoePe.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OuRvoePe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6462.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\SwiftCopy$2498799.exe"C:\Users\Admin\AppData\Local\Temp\SwiftCopy$2498799.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SwiftCopy$2498799.exe"C:\Users\Admin\AppData\Local\Temp\SwiftCopy$2498799.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3984 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_eiwox40p.jtx.ps1
tmp6462.tmp
memory/2228-8-0x0000000005950000-0x0000000005958000-memory.dmp
memory/2228-3-0x0000000005450000-0x00000000054E2000-memory.dmp
memory/2228-6-0x0000000005730000-0x00000000057CC000-memory.dmp
memory/2228-7-0x0000000005930000-0x0000000005946000-memory.dmp
memory/2228-4-0x0000000005580000-0x0000000005590000-memory.dmp
memory/2228-9-0x0000000006BA0000-0x0000000006BAC000-memory.dmp
memory/2228-10-0x0000000006F00000-0x0000000006F84000-memory.dmp
memory/2228-5-0x0000000005510000-0x000000000551A000-memory.dmp
memory/2228-49-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/2228-17-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/2228-0-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/2228-2-0x0000000005960000-0x0000000005F04000-memory.dmp
memory/2228-20-0x0000000005580000-0x0000000005590000-memory.dmp
memory/2228-1-0x0000000000A00000-0x0000000000AAA000-memory.dmp
memory/4988-22-0x0000000005490000-0x00000000054A0000-memory.dmp
memory/4988-51-0x0000000006910000-0x000000000692E000-memory.dmp
memory/4988-94-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/4988-21-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/4988-78-0x0000000006EC0000-0x0000000006EDE000-memory.dmp
memory/4988-81-0x0000000007C20000-0x0000000007C3A000-memory.dmp
memory/4988-24-0x0000000005A30000-0x0000000005A52000-memory.dmp
memory/4988-48-0x0000000006350000-0x00000000066A4000-memory.dmp
memory/4988-83-0x0000000007EA0000-0x0000000007F36000-memory.dmp
memory/4988-85-0x0000000007E50000-0x0000000007E5E000-memory.dmp
memory/4988-58-0x00000000713D0000-0x000000007141C000-memory.dmp
memory/4988-55-0x000000007F920000-0x000000007F930000-memory.dmp
memory/4988-52-0x0000000006DD0000-0x0000000006E1C000-memory.dmp
memory/4988-88-0x0000000007F40000-0x0000000007F48000-memory.dmp
memory/4988-53-0x0000000005490000-0x00000000054A0000-memory.dmp
memory/5188-98-0x00000000052D0000-0x00000000052E0000-memory.dmp
memory/5188-50-0x00000000052D0000-0x00000000052E0000-memory.dmp
memory/5188-47-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/5188-97-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/5188-96-0x0000000006BD0000-0x0000000006C20000-memory.dmp
memory/5188-37-0x0000000000400000-0x0000000000442000-memory.dmp
memory/5504-18-0x0000000004D60000-0x0000000004D70000-memory.dmp
memory/5504-79-0x0000000007350000-0x00000000073F3000-memory.dmp
memory/5504-80-0x0000000007B30000-0x00000000081AA000-memory.dmp
memory/5504-82-0x00000000074E0000-0x00000000074EA000-memory.dmp
memory/5504-57-0x0000000006750000-0x0000000006782000-memory.dmp
memory/5504-84-0x0000000007690000-0x00000000076A1000-memory.dmp
memory/5504-68-0x00000000713D0000-0x000000007141C000-memory.dmp
memory/5504-86-0x00000000076D0000-0x00000000076E4000-memory.dmp
memory/5504-87-0x00000000077C0000-0x00000000077DA000-memory.dmp
memory/5504-56-0x000000007F400000-0x000000007F410000-memory.dmp
memory/5504-54-0x0000000004D60000-0x0000000004D70000-memory.dmp
memory/5504-30-0x0000000005A40000-0x0000000005AA6000-memory.dmp
memory/5504-36-0x0000000005AB0000-0x0000000005B16000-memory.dmp
memory/5504-95-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/5504-19-0x00000000053A0000-0x00000000059C8000-memory.dmp
memory/5504-16-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/5504-14-0x00000000027E0000-0x0000000002816000-memory.dmp