Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    15/05/2024, 10:36

General

  • Target

    3cf1272bbb24cd63faf26b69ab0eaeec8ce789a9e59030cfa79e40150d8ae286.exe

  • Size

    721KB

  • MD5

    35373ea173fb999636a21ad039ce4951

  • SHA1

    d477aa5c029736ca08b927935c901c5f53d454ff

  • SHA256

    3cf1272bbb24cd63faf26b69ab0eaeec8ce789a9e59030cfa79e40150d8ae286

  • SHA512

    83c8ff6bbede26092b21be38caa110d640ad48130ac5e8f48f84f18ede855e81da43420d49efcc905ddc7e448cb8a2f4ea6d2390edd69a878a305fda9b73b834

  • SSDEEP

    12288:mfTeH81jJUDu3+6fov6jk6Jl859MCzjDgC9h0LImZ1tzRI4aP/kR:38MDhyjk6J659M2j8tImVRii

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3cf1272bbb24cd63faf26b69ab0eaeec8ce789a9e59030cfa79e40150d8ae286.exe
    "C:\Users\Admin\AppData\Local\Temp\3cf1272bbb24cd63faf26b69ab0eaeec8ce789a9e59030cfa79e40150d8ae286.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3cf1272bbb24cd63faf26b69ab0eaeec8ce789a9e59030cfa79e40150d8ae286.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2656
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ClBZCJCLlsf.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2964
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ClBZCJCLlsf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4D94.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2012
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
        PID:2372
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2392

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\tmp4D94.tmp

            Filesize

            1KB

            MD5

            8dc1a1bd72d86709333f810f4f37e95c

            SHA1

            d53d43a0535beb5cba8ba9b70c072e7029b2fb55

            SHA256

            67f99432463b533067b71fde430f30aedff1649592621a7024f3cadfe7346f57

            SHA512

            d3a359565d42a0821cffba882a80206a79c939fa9dca3d01619fece64ae39eb2ee75a5304477e189dddd09b9b345e286ab85ef8e4434c92b21f3974569d7f45a

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\68FAN50BDL2CXVD7FVIM.temp

            Filesize

            7KB

            MD5

            54dbf2b7bfa0d8445c0ed04dcbd2e1cf

            SHA1

            4c74ae88ba7640cac8a7583496f18cbbf4978369

            SHA256

            4e1cf062cd828af4367aa130e1235cdef7cf657be2e29ff1fdf63f08989e4045

            SHA512

            983451675644561af3191bde7789189b36dcd7b09f052a64439f15670ecb33df085d30aeefa27bba625588ecb92556cdd1adbd7c615e0d0d7409c1d1f9e04c87

          • memory/2040-4-0x0000000000450000-0x0000000000460000-memory.dmp

            Filesize

            64KB

          • memory/2040-31-0x0000000074920000-0x000000007500E000-memory.dmp

            Filesize

            6.9MB

          • memory/2040-0-0x000000007492E000-0x000000007492F000-memory.dmp

            Filesize

            4KB

          • memory/2040-5-0x00000000004A0000-0x00000000004B6000-memory.dmp

            Filesize

            88KB

          • memory/2040-6-0x0000000005230000-0x00000000052B4000-memory.dmp

            Filesize

            528KB

          • memory/2040-2-0x0000000074920000-0x000000007500E000-memory.dmp

            Filesize

            6.9MB

          • memory/2040-1-0x0000000000FA0000-0x0000000001058000-memory.dmp

            Filesize

            736KB

          • memory/2040-3-0x0000000000410000-0x0000000000430000-memory.dmp

            Filesize

            128KB

          • memory/2392-25-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/2392-21-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/2392-30-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/2392-29-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/2392-28-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/2392-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/2392-23-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

          • memory/2392-19-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB