Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    15/05/2024, 10:36

General

  • Target

    BL&CO.exe

  • Size

    721KB

  • MD5

    35373ea173fb999636a21ad039ce4951

  • SHA1

    d477aa5c029736ca08b927935c901c5f53d454ff

  • SHA256

    3cf1272bbb24cd63faf26b69ab0eaeec8ce789a9e59030cfa79e40150d8ae286

  • SHA512

    83c8ff6bbede26092b21be38caa110d640ad48130ac5e8f48f84f18ede855e81da43420d49efcc905ddc7e448cb8a2f4ea6d2390edd69a878a305fda9b73b834

  • SSDEEP

    12288:mfTeH81jJUDu3+6fov6jk6Jl859MCzjDgC9h0LImZ1tzRI4aP/kR:38MDhyjk6J659M2j8tImVRii

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BL&CO.exe
    "C:\Users\Admin\AppData\Local\Temp\BL&CO.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\BL&CO.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2612
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ClBZCJCLlsf.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2692
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ClBZCJCLlsf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5928.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2664
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2520

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmp5928.tmp

          Filesize

          1KB

          MD5

          cc630b46d5e61ddc7d0a3b9278cea657

          SHA1

          cd8737bb888ed5f0428ef1507b76d62f37203b0a

          SHA256

          59cbc30640fd0da2b25032455eff4df69244de1517f7bdc63d1f7011b63a1cf1

          SHA512

          1b6a3b1f078cd323ab54bef98c9be2f63a5a960b1b926a4feee8c9ea9baa110c6aaff9ffa8772c56d63fb12694849ec0277cde7cb04858e4165dae1e7c0642c8

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6I1THCFS0RSEQQQB97LS.temp

          Filesize

          7KB

          MD5

          13ddf8387321f2b868a64e13c990ed33

          SHA1

          4ff24f5342137b42adca933d430cb1e38c8646e3

          SHA256

          5d5eeef0f9bf3ebb0c42d0348fe91983e4cb7f5ca083e2916c8b59597f518436

          SHA512

          d573a6b559e6770ea9534be55806942c0386cc749de718a898476ef80b7168445ec1134c8cea48425453a9c9f3f250f8f0fc554c41875dbc398792ec4d5db209

        • memory/2032-4-0x00000000003D0000-0x00000000003E0000-memory.dmp

          Filesize

          64KB

        • memory/2032-31-0x0000000074D30000-0x000000007541E000-memory.dmp

          Filesize

          6.9MB

        • memory/2032-0-0x0000000074D3E000-0x0000000074D3F000-memory.dmp

          Filesize

          4KB

        • memory/2032-5-0x0000000000420000-0x0000000000436000-memory.dmp

          Filesize

          88KB

        • memory/2032-6-0x00000000052B0000-0x0000000005334000-memory.dmp

          Filesize

          528KB

        • memory/2032-2-0x0000000074D30000-0x000000007541E000-memory.dmp

          Filesize

          6.9MB

        • memory/2032-1-0x0000000000150000-0x0000000000208000-memory.dmp

          Filesize

          736KB

        • memory/2032-3-0x0000000000530000-0x0000000000550000-memory.dmp

          Filesize

          128KB

        • memory/2520-19-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/2520-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2520-23-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/2520-21-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/2520-30-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/2520-29-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/2520-28-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/2520-25-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB