Analysis
-
max time kernel
145s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 10:20
Static task
static1
Behavioral task
behavioral1
Sample
AWB.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
AWB.exe
Resource
win10v2004-20240226-en
General
-
Target
AWB.exe
-
Size
744KB
-
MD5
7723ce30a13cd21918ec8a9ba6756f0f
-
SHA1
940e9d687cf6d972a365346802c0f8a9be5c1b21
-
SHA256
31aeeb6ce979eed704ead00a328df97e2d26690a02e5a29a1d2070dff1ab27b6
-
SHA512
e20c694048c1e552077bee886552a67da76ff4ef4ac26060a7fb5db78684602f47bcfdd2848ecbb029886a9b8dae18940137cfdddb64a88d9fa94eb433de7300
-
SSDEEP
12288:U1mwygw0BxF25eAMkeB+s/uUZ6VfQh/MjOcSKYGMAGZLYRtDmId0ajL6USkY:UBjZxgKTgs/uzfVj5Y0GRYOId0ajmuY
Malware Config
Extracted
Protocol: smtp- Host:
mail.shivomrealty.com - Port:
587 - Username:
[email protected] - Password:
Priya1982#
Extracted
agenttesla
Protocol: smtp- Host:
mail.shivomrealty.com - Port:
587 - Username:
[email protected] - Password:
Priya1982# - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AWB.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation AWB.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
AWB.exedescription pid process target process PID 2828 set thread context of 4356 2828 AWB.exe AWB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
AWB.exepowershell.exepowershell.exeAWB.exepid process 2828 AWB.exe 2828 AWB.exe 2828 AWB.exe 2828 AWB.exe 2828 AWB.exe 3192 powershell.exe 3192 powershell.exe 2748 powershell.exe 2748 powershell.exe 2828 AWB.exe 2828 AWB.exe 2828 AWB.exe 2828 AWB.exe 4356 AWB.exe 4356 AWB.exe 4356 AWB.exe 2748 powershell.exe 3192 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AWB.exepowershell.exepowershell.exeAWB.exedescription pid process Token: SeDebugPrivilege 2828 AWB.exe Token: SeDebugPrivilege 3192 powershell.exe Token: SeDebugPrivilege 2748 powershell.exe Token: SeDebugPrivilege 4356 AWB.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
AWB.exedescription pid process target process PID 2828 wrote to memory of 3192 2828 AWB.exe powershell.exe PID 2828 wrote to memory of 3192 2828 AWB.exe powershell.exe PID 2828 wrote to memory of 3192 2828 AWB.exe powershell.exe PID 2828 wrote to memory of 2748 2828 AWB.exe powershell.exe PID 2828 wrote to memory of 2748 2828 AWB.exe powershell.exe PID 2828 wrote to memory of 2748 2828 AWB.exe powershell.exe PID 2828 wrote to memory of 2192 2828 AWB.exe schtasks.exe PID 2828 wrote to memory of 2192 2828 AWB.exe schtasks.exe PID 2828 wrote to memory of 2192 2828 AWB.exe schtasks.exe PID 2828 wrote to memory of 3444 2828 AWB.exe AWB.exe PID 2828 wrote to memory of 3444 2828 AWB.exe AWB.exe PID 2828 wrote to memory of 3444 2828 AWB.exe AWB.exe PID 2828 wrote to memory of 4124 2828 AWB.exe AWB.exe PID 2828 wrote to memory of 4124 2828 AWB.exe AWB.exe PID 2828 wrote to memory of 4124 2828 AWB.exe AWB.exe PID 2828 wrote to memory of 4356 2828 AWB.exe AWB.exe PID 2828 wrote to memory of 4356 2828 AWB.exe AWB.exe PID 2828 wrote to memory of 4356 2828 AWB.exe AWB.exe PID 2828 wrote to memory of 4356 2828 AWB.exe AWB.exe PID 2828 wrote to memory of 4356 2828 AWB.exe AWB.exe PID 2828 wrote to memory of 4356 2828 AWB.exe AWB.exe PID 2828 wrote to memory of 4356 2828 AWB.exe AWB.exe PID 2828 wrote to memory of 4356 2828 AWB.exe AWB.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AWB.exe"C:\Users\Admin\AppData\Local\Temp\AWB.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\AWB.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tDWYgnAToHH.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tDWYgnAToHH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9DE6.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\AWB.exe"C:\Users\Admin\AppData\Local\Temp\AWB.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\AWB.exe"C:\Users\Admin\AppData\Local\Temp\AWB.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\AWB.exe"C:\Users\Admin\AppData\Local\Temp\AWB.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5bda22a3c6391ab35c1a17a10a42d10a4
SHA16b0e1fe17974888f8b11c36ccb579c20c499b214
SHA256ad947dd79dcd2bae9771f64b0fbac97b92daf23eb93b18aad25da0a46b8a3de6
SHA512e36f5fff93d337c12cff4986344075c9dea8143ed94d6cdd3a0511e41e56024385bf7a9ab18a1e19063116235e8b3375f9d6efe2303c574809529c966a9fda2a
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kkyddgyn.30o.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp9DE6.tmpFilesize
1KB
MD5bbb65d33f260c684107872cdd756c26c
SHA11181753aeccd58817874b9144934f4c3a25bb40f
SHA256943d1769d519be037186bbc4ec35b0d9d48dda94ddb29f4f4b71c9f1de4cda07
SHA512bef9af694f972d777fff2ada4d3969611924d558241d520f013fe4cc2f299ec11f2c8e913bb2aeb6cb04686af73d370008171027846412df6e9c325237bae993
-
memory/2748-80-0x0000000007B30000-0x0000000007B3A000-memory.dmpFilesize
40KB
-
memory/2748-40-0x0000000006150000-0x00000000064A4000-memory.dmpFilesize
3.3MB
-
memory/2748-94-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB
-
memory/2748-86-0x0000000007E00000-0x0000000007E1A000-memory.dmpFilesize
104KB
-
memory/2748-81-0x0000000007D40000-0x0000000007DD6000-memory.dmpFilesize
600KB
-
memory/2748-79-0x0000000007AC0000-0x0000000007ADA000-memory.dmpFilesize
104KB
-
memory/2748-51-0x0000000005520000-0x000000000553E000-memory.dmpFilesize
120KB
-
memory/2748-67-0x0000000006D70000-0x0000000006D8E000-memory.dmpFilesize
120KB
-
memory/2748-16-0x0000000002E50000-0x0000000002E60000-memory.dmpFilesize
64KB
-
memory/2748-17-0x0000000005210000-0x0000000005246000-memory.dmpFilesize
216KB
-
memory/2748-18-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB
-
memory/2748-52-0x0000000006860000-0x00000000068AC000-memory.dmpFilesize
304KB
-
memory/2748-20-0x0000000005880000-0x0000000005EA8000-memory.dmpFilesize
6.2MB
-
memory/2748-56-0x00000000759B0000-0x00000000759FC000-memory.dmpFilesize
304KB
-
memory/2748-22-0x00000000057D0000-0x00000000057F2000-memory.dmpFilesize
136KB
-
memory/2748-24-0x0000000006020000-0x0000000006086000-memory.dmpFilesize
408KB
-
memory/2748-53-0x000000007F600000-0x000000007F610000-memory.dmpFilesize
64KB
-
memory/2828-4-0x00000000050F0000-0x0000000005100000-memory.dmpFilesize
64KB
-
memory/2828-5-0x00000000052F0000-0x00000000052FA000-memory.dmpFilesize
40KB
-
memory/2828-45-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB
-
memory/2828-6-0x00000000054F0000-0x000000000558C000-memory.dmpFilesize
624KB
-
memory/2828-1-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB
-
memory/2828-48-0x00000000050F0000-0x0000000005100000-memory.dmpFilesize
64KB
-
memory/2828-50-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB
-
memory/2828-2-0x0000000005780000-0x0000000005D24000-memory.dmpFilesize
5.6MB
-
memory/2828-7-0x00000000054B0000-0x00000000054C2000-memory.dmpFilesize
72KB
-
memory/2828-8-0x00000000054D0000-0x00000000054DC000-memory.dmpFilesize
48KB
-
memory/2828-0-0x0000000000760000-0x0000000000820000-memory.dmpFilesize
768KB
-
memory/2828-9-0x0000000006930000-0x00000000069B2000-memory.dmpFilesize
520KB
-
memory/2828-3-0x0000000005100000-0x0000000005192000-memory.dmpFilesize
584KB
-
memory/3192-66-0x00000000759B0000-0x00000000759FC000-memory.dmpFilesize
304KB
-
memory/3192-83-0x0000000007230000-0x000000000723E000-memory.dmpFilesize
56KB
-
memory/3192-54-0x000000007FB70000-0x000000007FB80000-memory.dmpFilesize
64KB
-
memory/3192-77-0x0000000006CC0000-0x0000000006D63000-memory.dmpFilesize
652KB
-
memory/3192-78-0x0000000007630000-0x0000000007CAA000-memory.dmpFilesize
6.5MB
-
memory/3192-55-0x0000000006C70000-0x0000000006CA2000-memory.dmpFilesize
200KB
-
memory/3192-93-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB
-
memory/3192-19-0x0000000004930000-0x0000000004940000-memory.dmpFilesize
64KB
-
memory/3192-82-0x00000000071F0000-0x0000000007201000-memory.dmpFilesize
68KB
-
memory/3192-15-0x0000000004930000-0x0000000004940000-memory.dmpFilesize
64KB
-
memory/3192-23-0x0000000004CA0000-0x0000000004D06000-memory.dmpFilesize
408KB
-
memory/3192-85-0x0000000007240000-0x0000000007254000-memory.dmpFilesize
80KB
-
memory/3192-14-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB
-
memory/3192-87-0x0000000007310000-0x0000000007318000-memory.dmpFilesize
32KB
-
memory/4356-84-0x0000000006570000-0x00000000065C0000-memory.dmpFilesize
320KB
-
memory/4356-46-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB
-
memory/4356-25-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/4356-49-0x00000000056A0000-0x00000000056B0000-memory.dmpFilesize
64KB
-
memory/4356-95-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB