Analysis
-
max time kernel
67s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
28-04-2024 18:21
General
-
Target
Zwle Perm V3.0.0.2.exe
-
Size
2.8MB
-
MD5
77a9cc4377538f59a59003bd77cc994b
-
SHA1
f516c856119b0fef681a491e40d560a8e0867d30
-
SHA256
58806e1209b95a365b5a0f4868f5c964c99f05fa33a3547228801ed123e27c4a
-
SHA512
0279fe79a4bc484b08423453a6b572489506b27f8bc7caaba8709d3aef8fc7142ff0ab5b1c140076807b1231cc78908e956c7ac03e2a136a9aa46e4e730bfdcb
-
SSDEEP
49152:6ZB1G8YlKsep9Xeuv7jYyPlYEyO3VfpUhhkTngHk88tlJciK2ZrWq7Lx+6zz:g3GHKseiu3zPlYERNpU3MgE88632ZrDv
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 2 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Zwle Perm V3.0.0.2.exe"C:\Users\Admin\AppData\Local\Temp\Zwle Perm V3.0.0.2.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Zwle Perm.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Zwle Perm.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 19043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2116 -ip 21161⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5c19e9e6a4bc1b668d19505a0437e7f7e
SHA173be712aef4baa6e9dabfc237b5c039f62a847fa
SHA2569ac8b65e5c13292a8e564187c1e7446adc4230228b669383bd7b07035ab99a82
SHA512b6cd0af436459f35a97db2d928120c53d3691533b01e4f0e8b382f2bd81d9a9a2c57e5e2aa6ade9d6a1746d5c4b2ef6c88d3a0cf519424b34445d0d30aab61de
-
Filesize
1.6MB
MD5f72ac665049a7d1047c92a148afe6909
SHA1b0ce4898be969862c872c5e95408658ad9eb2636
SHA256bf7e42bdccfb470b2f0cce04242c0e0def2a45a9aff19bd91a7de2bfde36573c
SHA5128a1fafbcff9d750da5acd87bccbf2270766a19af2963588b63cf750cac54a51ef150b9c99d26ccdd8fbcca623e39d89223e6fc9660aac5bd6ee20856ded320ef
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
1.7MB
-
Filesize
2.1MB
-
Filesize
7.7MB