Analysis

  • max time kernel
    215s
  • max time network
    204s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07-04-2024 19:29

General

  • Target

    Debug.rar

  • Size

    703KB

  • MD5

    5d00873f5d1dfe75027ec6deb35bb518

  • SHA1

    b4d448bb0e10be9f5926a567934d8c42e6124afb

  • SHA256

    651f2668229b6d9e70b599c4321f219ee98a7b86e137c98f596bdd8aff092952

  • SHA512

    80c0a895adb1e33991e173b51f34e8c38e09a5eb9852a66cfbc3871b8ed8df61e3bdb8bfc42727f577a2c441b0c5952e68a6a2905b38f577b8b4fe81d128b453

  • SSDEEP

    12288:3aFVmOAhdHxdPLn931grPRhzkZJXNQTIWGk9HzA1ulSg5rpFk2vLTC:qrATxdDgfzEJXGTGkW1kSg7LTu

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Debug.rar
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1340
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Debug.rar"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2420
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4920
    • C:\Users\Admin\Desktop\Debug\spoofer.exe
      "C:\Users\Admin\Desktop\Debug\spoofer.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4008
      • C:\Windows\kdmapper.exe
        "C:\Windows\kdmapper.exe" C:\Windows\randomisershit.sys
        2⤵
        • Executes dropped EXE
        PID:1696
      • C:\Windows\kdmapper.exe
        "C:\Windows\kdmapper.exe" C:\Windows\randomisershit.sys
        2⤵
        • Executes dropped EXE
        PID:3916

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Desktop\Debug\Guna.UI2.dll

      Filesize

      2.1MB

      MD5

      c19e9e6a4bc1b668d19505a0437e7f7e

      SHA1

      73be712aef4baa6e9dabfc237b5c039f62a847fa

      SHA256

      9ac8b65e5c13292a8e564187c1e7446adc4230228b669383bd7b07035ab99a82

      SHA512

      b6cd0af436459f35a97db2d928120c53d3691533b01e4f0e8b382f2bd81d9a9a2c57e5e2aa6ade9d6a1746d5c4b2ef6c88d3a0cf519424b34445d0d30aab61de

    • C:\Users\Admin\Desktop\Debug\spoofer.exe

      Filesize

      21KB

      MD5

      21f19140a3b8776b727dd7694104f022

      SHA1

      9da6d5697eb0c502087665b35b8584e56ad2f731

      SHA256

      314e35c83f5f2189825aa4bc0eeaeb422e65ca10e9b72e9d0dc9388ddccaa9f8

      SHA512

      a6ca853197f61535bd3a76d3bb66bfdf9f36e1f7eb6bb55052eeb2a790bb49d965c8cd6bc0c6ab26b59defe4ddd7e7e2edf87cfece1a02b758ae3d9632c127aa

    • C:\Users\Admin\Desktop\Debug\spoofer.exe.config

      Filesize

      189B

      MD5

      9dbad5517b46f41dbb0d8780b20ab87e

      SHA1

      ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e

      SHA256

      47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf

      SHA512

      43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8

    • C:\Windows\kdmapper.exe

      Filesize

      534KB

      MD5

      e712f7853f09f263df3c012e4e9fad57

      SHA1

      0cee125bc2f87d9808fd09ddb291f029a6c43dba

      SHA256

      990ebe210d7459c86374c5619291981062176930e857312974f89df1f72395a9

      SHA512

      886bb345269f2cb3d97caee8b64e39328fd3bbe35766cfe9e63874bcd69e752b8e15ef54f33c201b4ad32160f954bb9cc096a28134c1b2ad2b10ef0b030dd379

    • memory/1696-30-0x00007FF7ACF90000-0x00007FF7AD043000-memory.dmp

      Filesize

      716KB

    • memory/3916-43-0x00007FF6A68D0000-0x00007FF6A6983000-memory.dmp

      Filesize

      716KB

    • memory/4008-14-0x0000000005040000-0x00000000050D2000-memory.dmp

      Filesize

      584KB

    • memory/4008-15-0x0000000005230000-0x0000000005240000-memory.dmp

      Filesize

      64KB

    • memory/4008-16-0x0000000005000000-0x000000000500A000-memory.dmp

      Filesize

      40KB

    • memory/4008-13-0x00000000055F0000-0x0000000005B96000-memory.dmp

      Filesize

      5.6MB

    • memory/4008-20-0x0000000005BA0000-0x0000000005DB4000-memory.dmp

      Filesize

      2.1MB

    • memory/4008-21-0x0000000005230000-0x0000000005240000-memory.dmp

      Filesize

      64KB

    • memory/4008-12-0x0000000074800000-0x0000000074FB1000-memory.dmp

      Filesize

      7.7MB

    • memory/4008-11-0x0000000000550000-0x000000000055C000-memory.dmp

      Filesize

      48KB

    • memory/4008-32-0x0000000074800000-0x0000000074FB1000-memory.dmp

      Filesize

      7.7MB

    • memory/4008-33-0x0000000005230000-0x0000000005240000-memory.dmp

      Filesize

      64KB

    • memory/4008-34-0x0000000005230000-0x0000000005240000-memory.dmp

      Filesize

      64KB