Analysis
- max time kernel
142s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
15/05/2024, 00:48
General
- Target rRFQ_251477800TM.exe
- Size 699KB
- Sample240515-a5r4kshc34
- SHA256 21b046d70a17b53ef0fe65babaf531affca080ff22a167f5c38393f6534a47d6
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.musabody.com
-
Port
587
-
Username
-
Password
MUSAbody_victoria2018
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.musabody.com
-
Port
587
-
Username
-
Password
MUSAbody_victoria2018
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rRFQ_251477800TM.exe"C:\Users\Admin\AppData\Local\Temp\rRFQ_251477800TM.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\rRFQ_251477800TM.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\rRFQ_251477800TM.exe"C:\Users\Admin\AppData\Local\Temp\rRFQ_251477800TM.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3912 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_xoyylafh.2uc.ps1
memory/1560-12-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1560-63-0x0000000074E40000-0x00000000755F0000-memory.dmp
memory/1560-37-0x0000000005E20000-0x0000000005E70000-memory.dmp
memory/1560-19-0x0000000004E80000-0x0000000004EE6000-memory.dmp
memory/1560-18-0x0000000074E40000-0x00000000755F0000-memory.dmp
memory/1560-15-0x0000000074E40000-0x00000000755F0000-memory.dmp
memory/3928-49-0x00000000067E0000-0x00000000067FE000-memory.dmp
memory/3928-33-0x0000000005DB0000-0x0000000006104000-memory.dmp
memory/3928-62-0x0000000074E40000-0x00000000755F0000-memory.dmp
memory/3928-59-0x0000000007860000-0x0000000007868000-memory.dmp
memory/3928-58-0x0000000007880000-0x000000000789A000-memory.dmp
memory/3928-57-0x0000000007780000-0x0000000007794000-memory.dmp
memory/3928-56-0x0000000007770000-0x000000000777E000-memory.dmp
memory/3928-55-0x0000000007740000-0x0000000007751000-memory.dmp
memory/3928-17-0x0000000074E40000-0x00000000755F0000-memory.dmp
memory/3928-16-0x0000000004C40000-0x0000000004C76000-memory.dmp
memory/3928-54-0x00000000077C0000-0x0000000007856000-memory.dmp
memory/3928-53-0x00000000075B0000-0x00000000075BA000-memory.dmp
memory/3928-20-0x0000000074E40000-0x00000000755F0000-memory.dmp
memory/3928-21-0x00000000052C0000-0x00000000058E8000-memory.dmp
memory/3928-22-0x0000000005210000-0x0000000005232000-memory.dmp
memory/3928-23-0x0000000005AE0000-0x0000000005B46000-memory.dmp
memory/3928-52-0x00000000068E0000-0x00000000068FA000-memory.dmp
memory/3928-51-0x0000000007BF0000-0x000000000826A000-memory.dmp
memory/3928-34-0x0000000006230000-0x000000000624E000-memory.dmp
memory/3928-35-0x0000000006310000-0x000000000635C000-memory.dmp
memory/3928-50-0x00000000074C0000-0x0000000007563000-memory.dmp
memory/3928-38-0x0000000006800000-0x0000000006832000-memory.dmp
memory/3928-39-0x0000000070AC0000-0x0000000070B0C000-memory.dmp
memory/4416-14-0x0000000074E40000-0x00000000755F0000-memory.dmp
memory/4416-2-0x00000000059D0000-0x0000000005F74000-memory.dmp
memory/4416-8-0x0000000006C60000-0x0000000006C70000-memory.dmp
memory/4416-3-0x0000000005330000-0x00000000053C2000-memory.dmp
memory/4416-4-0x0000000074E40000-0x00000000755F0000-memory.dmp
memory/4416-5-0x00000000053F0000-0x00000000053FA000-memory.dmp
memory/4416-0-0x0000000074E4E000-0x0000000074E4F000-memory.dmp
memory/4416-6-0x0000000005970000-0x0000000005990000-memory.dmp
memory/4416-7-0x0000000074E4E000-0x0000000074E4F000-memory.dmp
memory/4416-11-0x00000000096C0000-0x000000000975C000-memory.dmp
memory/4416-10-0x0000000006FF0000-0x0000000007072000-memory.dmp
memory/4416-9-0x0000000006C70000-0x0000000006C86000-memory.dmp
memory/4416-1-0x00000000008E0000-0x0000000000996000-memory.dmp