Analysis

  • max time kernel
    126s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-05-2024 20:23

General

  • Target

    RocketTitles.exe

  • Size

    464KB

  • MD5

    bbe823f014a8c096fdc9716a18929faa

  • SHA1

    0ceb43841a339c2968ea17da76ab9c889e7a80f6

  • SHA256

    7795617b9288dfffb6fcfcdb4fb1be7945ffdd05eb72a79650c686f8fea6a778

  • SHA512

    5799b27c06a8ff42ec493a90787318e0e784261a08eae35e60d7ac75f47dae17bdeb9627793324d228f5597e6519c980843e30e621b2fce269b5b62cf36ff2dd

  • SSDEEP

    12288:Tizs0QrkDUyTfvqCT/4k2QjqGpNBOewDlA:TPIDR3qCr4khqGrUtDlA

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect Umbral payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • AgentTesla payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RocketTitles.exe
    "C:\Users\Admin\AppData\Local\Temp\RocketTitles.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5076
    • C:\Windows\uuui.exe
      "C:\Windows\uuui.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5052
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4136
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Windows\uuui.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2556
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3668
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3256
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2068
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" os get Caption
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4344
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" computersystem get totalphysicalmemory
        3⤵
          PID:4788
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          3⤵
            PID:1932
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2312
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic" path win32_VideoController get name
            3⤵
            • Detects videocard installed
            PID:3680
      • C:\Windows\system32\notepad.exe
        "C:\Windows\system32\notepad.exe"
        1⤵
          PID:4768

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          d85ba6ff808d9e5444a4b369f5bc2730

          SHA1

          31aa9d96590fff6981b315e0b391b575e4c0804a

          SHA256

          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

          SHA512

          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          2984662ba3f86d7fcf26758b5b76754d

          SHA1

          bc2a43ffd898222ee84406313f3834f226928379

          SHA256

          f0815f797b0c1829745dd65985f28d459688f91ceb2f3d76fed2d4309589bcde

          SHA512

          a06251a7a14559ebf5627a3c6b03fda9ded1d4ee44991283c824ccf5011cdf67665696d2d9b23507cbb3e3b9943b9e9f79ef28d3657eb61fb99920225417ab11

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          62623d22bd9e037191765d5083ce16a3

          SHA1

          4a07da6872672f715a4780513d95ed8ddeefd259

          SHA256

          95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

          SHA512

          9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          948B

          MD5

          28ef595a6cc9f47b8eccb22d4ed50d6c

          SHA1

          4335de707324b15eba79017938c3da2752d3eea5

          SHA256

          3abd14d4fe7b5697b2fa84993e7183f4fd2580be5b4e5150da15ddda5a9560b9

          SHA512

          687b7849faa62a4dabc240b573afa163f0cda9a80be61cebe28ef1461777744d73b465ac92d065093228068540846e79c899445057f5b906f9b9fa9868132208

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          276798eeb29a49dc6e199768bc9c2e71

          SHA1

          5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

          SHA256

          cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

          SHA512

          0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ovnmdzv.z3v.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Windows\uuui.exe

          Filesize

          229KB

          MD5

          dd294f4a30b78637d2de6ae794442508

          SHA1

          2f28200fb482bb7f280ecde35070b8bf181900ef

          SHA256

          a89f3d297cbac8b605cd554dd0ea7891c7fcff9e63c7c22810d1c8121fd128b1

          SHA512

          cc4343ab3d9dc6f6eb8312a28df24442280144d3c54fe3fca65412b6285ae98c264a67a70a86b1fd73418bee535ea5adbe968e7b48a40ad833beaabf459d7bf5

        • memory/2556-32-0x000001A6FA410000-0x000001A6FA432000-memory.dmp

          Filesize

          136KB

        • memory/5052-94-0x0000029FC2E60000-0x0000029FC2E6A000-memory.dmp

          Filesize

          40KB

        • memory/5052-56-0x0000029FDB7D0000-0x0000029FDB846000-memory.dmp

          Filesize

          472KB

        • memory/5052-57-0x0000029FDB850000-0x0000029FDB8A0000-memory.dmp

          Filesize

          320KB

        • memory/5052-58-0x0000029FC2E30000-0x0000029FC2E4E000-memory.dmp

          Filesize

          120KB

        • memory/5052-95-0x0000029FC2E90000-0x0000029FC2EA2000-memory.dmp

          Filesize

          72KB

        • memory/5052-29-0x0000029FC1080000-0x0000029FC10C0000-memory.dmp

          Filesize

          256KB

        • memory/5076-7-0x00000000061E0000-0x00000000063F4000-memory.dmp

          Filesize

          2.1MB

        • memory/5076-9-0x00000000099F0000-0x0000000009A12000-memory.dmp

          Filesize

          136KB

        • memory/5076-15-0x0000000074F50000-0x0000000075700000-memory.dmp

          Filesize

          7.7MB

        • memory/5076-14-0x0000000074F5E000-0x0000000074F5F000-memory.dmp

          Filesize

          4KB

        • memory/5076-13-0x0000000074F50000-0x0000000075700000-memory.dmp

          Filesize

          7.7MB

        • memory/5076-12-0x0000000009B40000-0x0000000009B7C000-memory.dmp

          Filesize

          240KB

        • memory/5076-10-0x0000000007200000-0x0000000007554000-memory.dmp

          Filesize

          3.3MB

        • memory/5076-16-0x0000000074F50000-0x0000000075700000-memory.dmp

          Filesize

          7.7MB

        • memory/5076-8-0x0000000009A40000-0x0000000009AF2000-memory.dmp

          Filesize

          712KB

        • memory/5076-0-0x0000000074F5E000-0x0000000074F5F000-memory.dmp

          Filesize

          4KB

        • memory/5076-6-0x0000000074F50000-0x0000000075700000-memory.dmp

          Filesize

          7.7MB

        • memory/5076-5-0x0000000005940000-0x000000000594A000-memory.dmp

          Filesize

          40KB

        • memory/5076-4-0x0000000005710000-0x0000000005722000-memory.dmp

          Filesize

          72KB

        • memory/5076-3-0x0000000005760000-0x00000000057F2000-memory.dmp

          Filesize

          584KB

        • memory/5076-2-0x0000000005C30000-0x00000000061D4000-memory.dmp

          Filesize

          5.6MB

        • memory/5076-1-0x0000000000D00000-0x0000000000D7A000-memory.dmp

          Filesize

          488KB