Analysis
- max time kernel
144s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
20/03/2024, 14:05
General
- Target Purchase Order.exe
- Size 686KB
- Sample240320-rdtxjaab45
- SHA256 883c03eade18d7b56edf9b057f55d4976ba31c2557aaf583197e3ca9b2d8a775
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.wasstech.com
-
Port
587
-
Username
-
Password
Sunray2700@@
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oYAjVNfYZW.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oYAjVNfYZW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6D02.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ikqqsyov.hrl.ps1
tmp6D02.tmp
memory/540-66-0x0000000071240000-0x000000007128C000-memory.dmp
memory/540-51-0x0000000006470000-0x000000000648E000-memory.dmp
memory/540-82-0x0000000007820000-0x000000000782A000-memory.dmp
memory/540-55-0x000000007F120000-0x000000007F130000-memory.dmp
memory/540-84-0x00000000079B0000-0x00000000079C1000-memory.dmp
memory/540-53-0x0000000007430000-0x0000000007462000-memory.dmp
memory/540-79-0x0000000002D50000-0x0000000002D60000-memory.dmp
memory/540-15-0x0000000002B90000-0x0000000002BC6000-memory.dmp
memory/540-17-0x00000000056E0000-0x0000000005D08000-memory.dmp
memory/540-16-0x0000000074B70000-0x0000000075320000-memory.dmp
memory/540-18-0x0000000002D50000-0x0000000002D60000-memory.dmp
memory/540-19-0x0000000002D50000-0x0000000002D60000-memory.dmp
memory/540-95-0x0000000074B70000-0x0000000075320000-memory.dmp
memory/540-85-0x00000000079E0000-0x00000000079EE000-memory.dmp
memory/540-86-0x00000000079F0000-0x0000000007A04000-memory.dmp
memory/540-45-0x0000000006050000-0x00000000063A4000-memory.dmp
memory/540-87-0x0000000007AF0000-0x0000000007B0A000-memory.dmp
memory/3408-2-0x0000000005D80000-0x0000000006324000-memory.dmp
memory/3408-48-0x0000000074B70000-0x0000000075320000-memory.dmp
memory/3408-3-0x00000000058B0000-0x0000000005942000-memory.dmp
memory/3408-1-0x0000000074B70000-0x0000000075320000-memory.dmp
memory/3408-4-0x0000000005A50000-0x0000000005A60000-memory.dmp
memory/3408-10-0x0000000007790000-0x0000000007814000-memory.dmp
memory/3408-9-0x0000000007430000-0x000000000743C000-memory.dmp
memory/3408-5-0x0000000005960000-0x000000000596A000-memory.dmp
memory/3408-0-0x0000000000E20000-0x0000000000ED0000-memory.dmp
memory/3408-8-0x0000000005D70000-0x0000000005D78000-memory.dmp
memory/3408-7-0x0000000005D30000-0x0000000005D46000-memory.dmp
memory/3408-6-0x0000000005B50000-0x0000000005BEC000-memory.dmp
memory/4116-23-0x0000000005940000-0x0000000005962000-memory.dmp
memory/4116-52-0x00000000060B0000-0x00000000060FC000-memory.dmp
memory/4116-67-0x000000007F410000-0x000000007F420000-memory.dmp
memory/4116-81-0x00000000073B0000-0x00000000073CA000-memory.dmp
memory/4116-80-0x00000000079F0000-0x000000000806A000-memory.dmp
memory/4116-65-0x0000000006630000-0x000000000664E000-memory.dmp
memory/4116-78-0x0000000007260000-0x0000000007303000-memory.dmp
memory/4116-54-0x0000000071240000-0x000000007128C000-memory.dmp
memory/4116-83-0x0000000007630000-0x00000000076C6000-memory.dmp
memory/4116-20-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
memory/4116-88-0x00000000076D0000-0x00000000076D8000-memory.dmp
memory/4116-77-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
memory/4116-94-0x0000000074B70000-0x0000000075320000-memory.dmp
memory/4116-44-0x0000000005BD0000-0x0000000005C36000-memory.dmp
memory/4116-29-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
memory/4116-21-0x0000000074B70000-0x0000000075320000-memory.dmp
memory/4116-34-0x0000000005B60000-0x0000000005BC6000-memory.dmp
memory/5016-46-0x0000000000400000-0x0000000000442000-memory.dmp
memory/5016-49-0x0000000074B70000-0x0000000075320000-memory.dmp
memory/5016-50-0x0000000004FF0000-0x0000000005000000-memory.dmp
memory/5016-96-0x00000000064B0000-0x0000000006500000-memory.dmp
memory/5016-97-0x0000000074B70000-0x0000000075320000-memory.dmp
memory/5016-98-0x0000000004FF0000-0x0000000005000000-memory.dmp