Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-04-2024 01:10

General

  • Target

    737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe

  • Size

    2.3MB

  • MD5

    2784277bd68152abf75c6c6d59fab7af

  • SHA1

    e1d047c97e3bdfe273b215b42eccde32ca2ca63f

  • SHA256

    737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc

  • SHA512

    e05b8251c9f6c59c7901d72c58f5b8c35dc376068368e67f81ee79da4287ddfc25c6ca5893d87944ed21c592bdd62f57d40a9f78c9af56762f33b010dd10b62c

  • SSDEEP

    49152:T2Q8G4mSmM8sik/AJ+/GRfzlW+oCZBNKoiYNsVjGMFWm02qG6zSo2:T2VmT8B4JAGllW+DBNdtN811

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect Umbral payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • AgentTesla payload 1 IoCs
  • Detects executables attemping to enumerate video devices using WMI 2 IoCs
  • Detects executables containing possible sandbox analysis VM names 2 IoCs
  • Detects executables containing possible sandbox analysis VM usernames 2 IoCs
  • Detects executables containing possible sandbox system UUIDs 2 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe
    "C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3684
    • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
      "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4052
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4404
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3648
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2100
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4288
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4820
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" os get Caption
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3328
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" computersystem get totalphysicalmemory
        3⤵
          PID:2728
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          3⤵
            PID:4532
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4044
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic" path win32_VideoController get name
            3⤵
            • Detects videocard installed
            PID:2592
        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of WriteProcessMemory
          PID:4808
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE
            3⤵
            • Modifies Windows Firewall
            PID:4260
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
            3⤵
            • Modifies Windows Firewall
            PID:1100
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE
            3⤵
            • Modifies Windows Firewall
            PID:3576
        • C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe
          "C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe"
          2⤵
          • Executes dropped EXE
          • Enumerates system info in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:4832

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        Filesize

        2KB

        MD5

        d85ba6ff808d9e5444a4b369f5bc2730

        SHA1

        31aa9d96590fff6981b315e0b391b575e4c0804a

        SHA256

        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

        SHA512

        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        948B

        MD5

        966914e2e771de7a4a57a95b6ecfa8a9

        SHA1

        7a32282fd51dd032967ed4d9a40cc57e265aeff2

        SHA256

        98d3c70d7004fa807897317bd6cd3e977b9b6c72d4d2565aca0f9f8b1c315cba

        SHA512

        dc39c7124a9c7c8d4c7e8e16290c46360b8d9a8f4e43edaacbbeb09bdcf20159a53db54d2b322372001b6a3de52b2f88e9088b5fdbc7638816ae0d122bb015f5

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        1KB

        MD5

        276798eeb29a49dc6e199768bc9c2e71

        SHA1

        5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

        SHA256

        cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

        SHA512

        0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        1KB

        MD5

        02f8663a4dcbe619beca9d48cd769bc0

        SHA1

        e17f0a4041da07f2003b3c45e1ccf89774bc15b8

        SHA256

        e1f3a8eab40520ad75dc4c12e2b5020440d3c0c90f030ff4622faa7d50c359f5

        SHA512

        852137d4fca911faf0c5e52991b09c30eb8baf1d219d25ae82a8c69aa27eab99683a9a63db49cc6f29baf11c089ecb956539e1135cda74a303775c4c811666c2

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        77d622bb1a5b250869a3238b9bc1402b

        SHA1

        d47f4003c2554b9dfc4c16f22460b331886b191b

        SHA256

        f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

        SHA512

        d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

      • C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe
        Filesize

        2.5MB

        MD5

        33eb68c8c4fc521d64ed82219cdb19f2

        SHA1

        2d114152924ea141df11082d6f337bf7e9a81035

        SHA256

        24251c6105a1f345dbb16860c2405647127b8b03e03b0d0c1c61f896a6c7b7b0

        SHA512

        0b5090dbb977ac8b79b01a3d33c26592a7b98bd9461212f70fa3c092b359c93ad22c1c4bace3aacc22c74884b154989be2a724edf74efd20ef80dee78ac75f8a

      • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
        Filesize

        231KB

        MD5

        774fa31e76af56bbad395e1e3ac68721

        SHA1

        fe65c14179b2cf0cbd44758578cf878d7dcef879

        SHA256

        944c19f992f5301ac8936dcdbd4efb59fbc4f47dcdcc39a77b5e87b4effd27f4

        SHA512

        529ba2a356bf4fb3d4820c0da1dca58d1583ae37188e61300190d543144140f0f73072a9faf195dc214a13ac8c365354e2ab212a24646a332085481f47de8c7e

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lar0ip4l.pfq.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        Filesize

        93KB

        MD5

        3071f4f7b11a6bf6c623e83eed6d2418

        SHA1

        37fd78d1296659109f2c94c9c750b5a98d158f11

        SHA256

        508bcd1a6b7ed82e60873eb1b035647ec9f8f9facdf65d6d6a73b8ef37d5bb9e

        SHA512

        e6bc32a3c955f80a9a54c261722f49032c1f32c50f98f0792af85769b87b4e9ef16ee4fd4f1e9e0a991e6f9311d54db99737401e6b5f32b503531e6859ad45b8

      • memory/2100-64-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp
        Filesize

        10.8MB

      • memory/2100-78-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp
        Filesize

        10.8MB

      • memory/2100-66-0x000001F13C340000-0x000001F13C350000-memory.dmp
        Filesize

        64KB

      • memory/2100-65-0x000001F13C340000-0x000001F13C350000-memory.dmp
        Filesize

        64KB

      • memory/3648-55-0x00000282EDC10000-0x00000282EDC32000-memory.dmp
        Filesize

        136KB

      • memory/3648-62-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp
        Filesize

        10.8MB

      • memory/3648-47-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp
        Filesize

        10.8MB

      • memory/3648-48-0x00000282D4D30000-0x00000282D4D40000-memory.dmp
        Filesize

        64KB

      • memory/3648-49-0x00000282D4D30000-0x00000282D4D40000-memory.dmp
        Filesize

        64KB

      • memory/3684-1-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp
        Filesize

        10.8MB

      • memory/3684-37-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp
        Filesize

        10.8MB

      • memory/3684-0-0x00000000005C0000-0x000000000081A000-memory.dmp
        Filesize

        2.4MB

      • memory/3684-3-0x0000000002940000-0x0000000002950000-memory.dmp
        Filesize

        64KB

      • memory/4044-139-0x000001AAF9680000-0x000001AAF9690000-memory.dmp
        Filesize

        64KB

      • memory/4044-138-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp
        Filesize

        10.8MB

      • memory/4044-152-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp
        Filesize

        10.8MB

      • memory/4052-133-0x000001937BC80000-0x000001937BC8A000-memory.dmp
        Filesize

        40KB

      • memory/4052-110-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp
        Filesize

        10.8MB

      • memory/4052-19-0x0000019379E60000-0x0000019379EA0000-memory.dmp
        Filesize

        256KB

      • memory/4052-40-0x000001937C500000-0x000001937C510000-memory.dmp
        Filesize

        64KB

      • memory/4052-31-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp
        Filesize

        10.8MB

      • memory/4052-81-0x000001937C690000-0x000001937C706000-memory.dmp
        Filesize

        472KB

      • memory/4052-82-0x000001937BC30000-0x000001937BC80000-memory.dmp
        Filesize

        320KB

      • memory/4052-83-0x000001937A330000-0x000001937A34E000-memory.dmp
        Filesize

        120KB

      • memory/4052-129-0x000001937C500000-0x000001937C510000-memory.dmp
        Filesize

        64KB

      • memory/4052-134-0x000001937C610000-0x000001937C622000-memory.dmp
        Filesize

        72KB

      • memory/4052-157-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp
        Filesize

        10.8MB

      • memory/4288-98-0x000002B4BEAD0000-0x000002B4BEAE0000-memory.dmp
        Filesize

        64KB

      • memory/4288-94-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp
        Filesize

        10.8MB

      • memory/4288-99-0x000002B4BEAD0000-0x000002B4BEAE0000-memory.dmp
        Filesize

        64KB

      • memory/4288-112-0x000002B4BEAD0000-0x000002B4BEAE0000-memory.dmp
        Filesize

        64KB

      • memory/4288-114-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp
        Filesize

        10.8MB

      • memory/4808-128-0x00000000752A0000-0x0000000075851000-memory.dmp
        Filesize

        5.7MB

      • memory/4808-39-0x00000000752A0000-0x0000000075851000-memory.dmp
        Filesize

        5.7MB

      • memory/4808-42-0x00000000752A0000-0x0000000075851000-memory.dmp
        Filesize

        5.7MB

      • memory/4820-117-0x0000026F76AA0000-0x0000026F76AB0000-memory.dmp
        Filesize

        64KB

      • memory/4820-131-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp
        Filesize

        10.8MB

      • memory/4820-115-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp
        Filesize

        10.8MB

      • memory/4820-116-0x0000026F76AA0000-0x0000026F76AB0000-memory.dmp
        Filesize

        64KB

      • memory/4832-137-0x0000023331020000-0x0000023331030000-memory.dmp
        Filesize

        64KB

      • memory/4832-86-0x000002334AD00000-0x000002334AD3C000-memory.dmp
        Filesize

        240KB

      • memory/4832-46-0x0000023331020000-0x0000023331030000-memory.dmp
        Filesize

        64KB

      • memory/4832-111-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp
        Filesize

        10.8MB

      • memory/4832-44-0x0000023349900000-0x0000023349B14000-memory.dmp
        Filesize

        2.1MB

      • memory/4832-140-0x0000023331020000-0x0000023331030000-memory.dmp
        Filesize

        64KB

      • memory/4832-43-0x0000023331020000-0x0000023331030000-memory.dmp
        Filesize

        64KB

      • memory/4832-41-0x0000023330EC0000-0x0000023330ED2000-memory.dmp
        Filesize

        72KB

      • memory/4832-36-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmp
        Filesize

        10.8MB

      • memory/4832-38-0x000002332EFB0000-0x000002332F22E000-memory.dmp
        Filesize

        2.5MB