Analysis

  • max time kernel
    115s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-05-2024 20:35

General

  • Target

    RocketTitles.exe

  • Size

    464KB

  • MD5

    85fc15eec7b28009db149df08f48a345

  • SHA1

    31ba87ded6a53820cb93dd7ecd913a7e0f895866

  • SHA256

    f959451391fd4bd257bddcec4d1ff4dcd5c0350d0748862437af5c1254020211

  • SHA512

    3b5b8988c89df153d8b2f70dbd4f838c3b82eb9065c6963c35e77c88d5497bf9c934b1a8a1c3a85170cada8a726b8e7390428bf470933493760c32b5f8912d7f

  • SSDEEP

    12288:Ihi0QGkDUyTfvqCT/4k2QjqGpNBOewDle:IUjDR3qCr4khqGrUtDle

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect Umbral payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • AgentTesla payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RocketTitles.exe
    "C:\Users\Admin\AppData\Local\Temp\RocketTitles.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Windows\uuui.exe
      "C:\Windows\uuui.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3996
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1596
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Windows\uuui.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1752
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3960
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3208
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1372
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" os get Caption
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1732
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" computersystem get totalphysicalmemory
        3⤵
          PID:4188
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          3⤵
            PID:1436
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4868
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic" path win32_VideoController get name
            3⤵
            • Detects videocard installed
            PID:4628
      • C:\Windows\system32\notepad.exe
        "C:\Windows\system32\notepad.exe"
        1⤵
          PID:2332

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          d85ba6ff808d9e5444a4b369f5bc2730

          SHA1

          31aa9d96590fff6981b315e0b391b575e4c0804a

          SHA256

          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

          SHA512

          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          7511c81925750deb7ad1b9b80eea8a8d

          SHA1

          6ea759b3cbd243ae11435c6d6c5ced185eb01f49

          SHA256

          5b49723a7773f2fe1f6093236e7b9b2c546f0873635d02346cb39535811234fa

          SHA512

          5f7e69316d39525d137a7a833f8c746ceef8f1b2295348393fb3244cca8b962fbaad0f7da49da453fe97e2c49b1f41f06138111ac5ff97fdc33c300350ec3a1b

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          6d42b6da621e8df5674e26b799c8e2aa

          SHA1

          ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

          SHA256

          5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

          SHA512

          53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          948B

          MD5

          966914e2e771de7a4a57a95b6ecfa8a9

          SHA1

          7a32282fd51dd032967ed4d9a40cc57e265aeff2

          SHA256

          98d3c70d7004fa807897317bd6cd3e977b9b6c72d4d2565aca0f9f8b1c315cba

          SHA512

          dc39c7124a9c7c8d4c7e8e16290c46360b8d9a8f4e43edaacbbeb09bdcf20159a53db54d2b322372001b6a3de52b2f88e9088b5fdbc7638816ae0d122bb015f5

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          548dd08570d121a65e82abb7171cae1c

          SHA1

          1a1b5084b3a78f3acd0d811cc79dbcac121217ab

          SHA256

          cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc

          SHA512

          37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ozpzbzcv.y5x.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Windows\uuui.exe

          Filesize

          229KB

          MD5

          dd294f4a30b78637d2de6ae794442508

          SHA1

          2f28200fb482bb7f280ecde35070b8bf181900ef

          SHA256

          a89f3d297cbac8b605cd554dd0ea7891c7fcff9e63c7c22810d1c8121fd128b1

          SHA512

          cc4343ab3d9dc6f6eb8312a28df24442280144d3c54fe3fca65412b6285ae98c264a67a70a86b1fd73418bee535ea5adbe968e7b48a40ad833beaabf459d7bf5

        • memory/1752-39-0x00000227D5090000-0x00000227D50B2000-memory.dmp

          Filesize

          136KB

        • memory/2916-7-0x0000000006440000-0x0000000006654000-memory.dmp

          Filesize

          2.1MB

        • memory/2916-5-0x00000000746F0000-0x0000000074EA0000-memory.dmp

          Filesize

          7.7MB

        • memory/2916-10-0x0000000009B50000-0x0000000009EA4000-memory.dmp

          Filesize

          3.3MB

        • memory/2916-12-0x0000000007600000-0x000000000763C000-memory.dmp

          Filesize

          240KB

        • memory/2916-13-0x00000000746F0000-0x0000000074EA0000-memory.dmp

          Filesize

          7.7MB

        • memory/2916-14-0x00000000746FE000-0x00000000746FF000-memory.dmp

          Filesize

          4KB

        • memory/2916-15-0x00000000746F0000-0x0000000074EA0000-memory.dmp

          Filesize

          7.7MB

        • memory/2916-16-0x00000000746F0000-0x0000000074EA0000-memory.dmp

          Filesize

          7.7MB

        • memory/2916-8-0x00000000074E0000-0x0000000007592000-memory.dmp

          Filesize

          712KB

        • memory/2916-1-0x0000000000ED0000-0x0000000000F4A000-memory.dmp

          Filesize

          488KB

        • memory/2916-0-0x00000000746FE000-0x00000000746FF000-memory.dmp

          Filesize

          4KB

        • memory/2916-9-0x0000000007490000-0x00000000074B2000-memory.dmp

          Filesize

          136KB

        • memory/2916-6-0x0000000005970000-0x000000000597A000-memory.dmp

          Filesize

          40KB

        • memory/2916-4-0x00000000058E0000-0x00000000058F2000-memory.dmp

          Filesize

          72KB

        • memory/2916-2-0x0000000005E90000-0x0000000006434000-memory.dmp

          Filesize

          5.6MB

        • memory/2916-3-0x0000000005980000-0x0000000005A12000-memory.dmp

          Filesize

          584KB

        • memory/3996-58-0x0000025A313C0000-0x0000025A313DE000-memory.dmp

          Filesize

          120KB

        • memory/3996-57-0x0000025A314C0000-0x0000025A31510000-memory.dmp

          Filesize

          320KB

        • memory/3996-56-0x0000025A31440000-0x0000025A314B6000-memory.dmp

          Filesize

          472KB

        • memory/3996-94-0x0000025A31410000-0x0000025A3141A000-memory.dmp

          Filesize

          40KB

        • memory/3996-95-0x0000025A31610000-0x0000025A31622000-memory.dmp

          Filesize

          72KB

        • memory/3996-29-0x0000025A16D00000-0x0000025A16D40000-memory.dmp

          Filesize

          256KB