Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/03/2024, 10:57
General
- Target JUSTIF.TRANSF..exe
- Size 798KB
- Sample240327-m19jaadf91
- SHA256 d2a44cec8dbbd996cc4b5780f907f33fd4040c44519653503f4b17f3288149a6
Malware Config
Extracted
-
agenttesla
-
https://api.telegram.org/bot7189076260:AAHEL9QuHqQcKXN8kPXNO5BpYSd3XtQOqFg/
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- UAC bypass 3 TTPs 1 IoCs
- Windows security bypass 2 TTPs 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Windows security modification 2 TTPs 3 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 35 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JUSTIF.TRANSF..exe"C:\Users\Admin\AppData\Local\Temp\JUSTIF.TRANSF..exe"1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\JUSTIF.TRANSF..exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_yaif2m1b.axc.ps1
memory/2728-7-0x000002E3C1F50000-0x000002E3C1F72000-memory.dmp
memory/2728-26-0x00007FFF27130000-0x00007FFF27BF1000-memory.dmp
memory/2728-23-0x000002E3DA570000-0x000002E3DA580000-memory.dmp
memory/2728-21-0x000002E3DA570000-0x000002E3DA580000-memory.dmp
memory/2728-8-0x00007FFF27130000-0x00007FFF27BF1000-memory.dmp
memory/2728-14-0x000002E3DA570000-0x000002E3DA580000-memory.dmp
memory/4024-6-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4024-28-0x0000000006730000-0x0000000006780000-memory.dmp
memory/4024-33-0x00000000053D0000-0x00000000053E0000-memory.dmp
memory/4024-32-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/4024-20-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/4024-31-0x00000000068D0000-0x00000000068DA000-memory.dmp
memory/4024-19-0x00000000057A0000-0x0000000005D44000-memory.dmp
memory/4024-22-0x00000000052F0000-0x0000000005356000-memory.dmp
memory/4024-30-0x0000000006960000-0x00000000069F2000-memory.dmp
memory/4024-29-0x0000000006820000-0x00000000068BC000-memory.dmp
memory/4908-3-0x0000028C6D2D0000-0x0000028C6D346000-memory.dmp
memory/4908-27-0x00007FFF27130000-0x00007FFF27BF1000-memory.dmp
memory/4908-1-0x00007FFF27130000-0x00007FFF27BF1000-memory.dmp
memory/4908-2-0x0000028C6C9D0000-0x0000028C6C9E0000-memory.dmp
memory/4908-0-0x0000028C6A380000-0x0000028C6A3BA000-memory.dmp
memory/4908-4-0x0000028C6C020000-0x0000028C6C03E000-memory.dmp
memory/4908-5-0x0000028C6D350000-0x0000028C6D3E4000-memory.dmp