Analysis
- max time kernel
143s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
25/03/2024, 16:26
General
- Target Statement of Accounts.exe
- Size 720KB
- Sample240325-txjxsaff3t
- SHA256 7f7230e7228c5ddd4e0536f6401123cc6eb5f3a6b1fb05abdce2d664870b590b
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.jitmachineryservices.co.ke
-
Port
587
-
Username
-
Password
NyambuClaris21@2024
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.jitmachineryservices.co.ke
-
Port
587
-
Username
-
Password
NyambuClaris21@2024
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Statement of Accounts.exe"C:\Users\Admin\AppData\Local\Temp\Statement of Accounts.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Statement of Accounts.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TUywoeoUNPADg.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TUywoeoUNPADg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6580.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_lhese0yf.02j.ps1
tmp6580.tmp
memory/1156-53-0x000000007F370000-0x000000007F380000-memory.dmp
memory/1156-77-0x0000000005010000-0x0000000005020000-memory.dmp
memory/1156-91-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/1156-86-0x00000000079A0000-0x00000000079B4000-memory.dmp
memory/1156-85-0x0000000007990000-0x000000000799E000-memory.dmp
memory/1156-84-0x0000000007960000-0x0000000007971000-memory.dmp
memory/1156-82-0x00000000077D0000-0x00000000077DA000-memory.dmp
memory/1156-51-0x00000000073E0000-0x0000000007412000-memory.dmp
memory/1156-54-0x00000000712A0000-0x00000000712EC000-memory.dmp
memory/1156-79-0x0000000005010000-0x0000000005020000-memory.dmp
memory/1156-49-0x0000000006430000-0x000000000644E000-memory.dmp
memory/1156-25-0x0000000005DF0000-0x0000000005E56000-memory.dmp
memory/1156-80-0x0000000007DA0000-0x000000000841A000-memory.dmp
memory/1156-19-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/1156-20-0x0000000005010000-0x0000000005020000-memory.dmp
memory/1156-23-0x0000000005C80000-0x0000000005CE6000-memory.dmp
memory/1156-50-0x00000000064D0000-0x000000000651C000-memory.dmp
memory/2060-95-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/2060-96-0x0000000005290000-0x00000000052A0000-memory.dmp
memory/2060-47-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/2060-94-0x0000000006720000-0x0000000006770000-memory.dmp
memory/2060-44-0x0000000000400000-0x0000000000444000-memory.dmp
memory/2060-48-0x0000000005290000-0x00000000052A0000-memory.dmp
memory/2608-18-0x0000000002CE0000-0x0000000002CF0000-memory.dmp
memory/2608-87-0x0000000007B60000-0x0000000007B7A000-memory.dmp
memory/2608-34-0x0000000005EC0000-0x0000000006214000-memory.dmp
memory/2608-22-0x0000000005630000-0x0000000005652000-memory.dmp
memory/2608-16-0x00000000056E0000-0x0000000005D08000-memory.dmp
memory/2608-52-0x00000000712A0000-0x00000000712EC000-memory.dmp
memory/2608-92-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/2608-64-0x00000000076C0000-0x00000000076DE000-memory.dmp
memory/2608-65-0x000000007FB80000-0x000000007FB90000-memory.dmp
memory/2608-17-0x0000000002CE0000-0x0000000002CF0000-memory.dmp
memory/2608-15-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/2608-78-0x0000000002CE0000-0x0000000002CF0000-memory.dmp
memory/2608-14-0x0000000002BD0000-0x0000000002C06000-memory.dmp
memory/2608-75-0x0000000002CE0000-0x0000000002CF0000-memory.dmp
memory/2608-76-0x00000000076F0000-0x0000000007793000-memory.dmp
memory/2608-88-0x0000000007B40000-0x0000000007B48000-memory.dmp
memory/2608-81-0x0000000007820000-0x000000000783A000-memory.dmp
memory/2608-83-0x0000000007AA0000-0x0000000007B36000-memory.dmp
memory/4300-8-0x0000000005540000-0x000000000554C000-memory.dmp
memory/4300-7-0x0000000005270000-0x0000000005282000-memory.dmp
memory/4300-6-0x00000000053A0000-0x000000000543C000-memory.dmp
memory/4300-5-0x0000000005070000-0x000000000507A000-memory.dmp
memory/4300-46-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/4300-9-0x0000000006660000-0x00000000066E6000-memory.dmp
memory/4300-0-0x0000000000600000-0x00000000006B8000-memory.dmp
memory/4300-4-0x00000000052F0000-0x0000000005300000-memory.dmp
memory/4300-3-0x00000000050E0000-0x0000000005172000-memory.dmp
memory/4300-2-0x00000000055F0000-0x0000000005B94000-memory.dmp
memory/4300-1-0x0000000074BD0000-0x0000000075380000-memory.dmp