Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
25-04-2024 01:55
General
-
Target
SARL RABINEAU Order FA2495.exe
-
Size
609KB
-
MD5
4ac88ef7fe497d568f8c0256627f4f28
-
SHA1
ed66aadb1b165388e5a132f43874f385db546379
-
SHA256
034a3732828ad09b79a12c66bf7eee3058427808bdae8b19291fffc828ee1fbf
-
SHA512
b20a18998275e42a27aa56ff0318e2a119b00a5ffee04898e42c25524ee4abf1e68952c97236d4ecafdd143a9912d87f15e463ea3e62ac1bc028e9bbac54fbab
-
SSDEEP
12288:IxbVNv5uSru57PQFztYF2vLRHQ36D78MmeOZWczK3rlHxsKIy:IxRV5Lru57YF+iQe8MdM0JOy
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.bonnyriggdentalsurgery.com.au - Port:
587 - Username:
[email protected] - Password:
Sages101* - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 2 IoCs
-
Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
-
Detects executables packed with or use KoiVM 1 IoCs
-
Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
-
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
-
Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
-
Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Windows security modification 2 TTPs 3 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SARL RABINEAU Order FA2495.exe"C:\Users\Admin\AppData\Local\Temp\SARL RABINEAU Order FA2495.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE53.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- UAC bypass
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\svchost.exe" -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5020 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_imp2lca3.ukq.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpE53.tmp.batFilesize
150B
MD59f117fea5913a1f2a0a5ea326fb3f58f
SHA1ee3b5d2c801e062e4db35bd355870a3d2eedd45a
SHA25631fe55c91fd87d3e99dfd27ca744e7386840199cfe579f9dd2e1e38798fbc4ba
SHA512d02ac0f42a2eb6b2715587161850a8688e1fdafd5ab7b5a1cfb392b91025d80571609fbe6552502e12265a25506f96f16f7e989ba1eccb2a6aff117b36aeacaf
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
609KB
MD54ac88ef7fe497d568f8c0256627f4f28
SHA1ed66aadb1b165388e5a132f43874f385db546379
SHA256034a3732828ad09b79a12c66bf7eee3058427808bdae8b19291fffc828ee1fbf
SHA512b20a18998275e42a27aa56ff0318e2a119b00a5ffee04898e42c25524ee4abf1e68952c97236d4ecafdd143a9912d87f15e463ea3e62ac1bc028e9bbac54fbab
-
memory/556-27-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/556-41-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/556-40-0x0000000006760000-0x000000000676A000-memory.dmpFilesize
40KB
-
memory/556-39-0x00000000067D0000-0x0000000006862000-memory.dmpFilesize
584KB
-
memory/556-38-0x00000000066E0000-0x0000000006730000-memory.dmpFilesize
320KB
-
memory/556-36-0x0000000005480000-0x00000000054E6000-memory.dmpFilesize
408KB
-
memory/556-35-0x0000000002E30000-0x0000000002E40000-memory.dmpFilesize
64KB
-
memory/556-33-0x0000000005A30000-0x0000000005FD4000-memory.dmpFilesize
5.6MB
-
memory/556-32-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/3860-26-0x0000015FB1FE0000-0x0000015FB1FF0000-memory.dmpFilesize
64KB
-
memory/3860-28-0x0000015FB1FE0000-0x0000015FB1FF0000-memory.dmpFilesize
64KB
-
memory/3860-31-0x00007FFD774B0000-0x00007FFD77F71000-memory.dmpFilesize
10.8MB
-
memory/3860-25-0x0000015FB1FE0000-0x0000015FB1FF0000-memory.dmpFilesize
64KB
-
memory/3860-23-0x00007FFD774B0000-0x00007FFD77F71000-memory.dmpFilesize
10.8MB
-
memory/3860-24-0x0000015FB2020000-0x0000015FB2042000-memory.dmpFilesize
136KB
-
memory/4660-34-0x00007FFD774B0000-0x00007FFD77F71000-memory.dmpFilesize
10.8MB
-
memory/4660-13-0x00007FFD774B0000-0x00007FFD77F71000-memory.dmpFilesize
10.8MB
-
memory/4752-0-0x0000022A956F0000-0x0000022A956FA000-memory.dmpFilesize
40KB
-
memory/4752-8-0x00007FFD774B0000-0x00007FFD77F71000-memory.dmpFilesize
10.8MB
-
memory/4752-3-0x0000022A95B20000-0x0000022A95BB6000-memory.dmpFilesize
600KB
-
memory/4752-2-0x0000022AAFC10000-0x0000022AAFC20000-memory.dmpFilesize
64KB
-
memory/4752-1-0x00007FFD774B0000-0x00007FFD77F71000-memory.dmpFilesize
10.8MB