Analysis

  • max time kernel
    136s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/05/2024, 01:57

General

  • Target

    5617a17faab361c772af5ec1b640097706a850742cd0fe040784c1a49ada20eb.exe

  • Size

    714KB

  • MD5

    8c1ade64563e1d563569198fbef99347

  • SHA1

    3247ea6bd149ed55884c6b1e4f0cdd2c5dae057e

  • SHA256

    5617a17faab361c772af5ec1b640097706a850742cd0fe040784c1a49ada20eb

  • SHA512

    4b7b87bf1ff17f1af9b7655b4962851b5cecc57ae1c6dff9b3a065db4da7f90b0a80bb77e19854cda474e176348612656ea57e11c2ab1a93e519b5efa1097080

  • SSDEEP

    12288:eWET/mr9KJHRNy7DTxuK4VVTIVzWjiLduh5PNAA83mFU8LJYwXfdm7+m+h:eWtd73gh8Vzr5uTP+Ak8FYUfdm7G

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.funworld.co.id
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    fwp123mail

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5617a17faab361c772af5ec1b640097706a850742cd0fe040784c1a49ada20eb.exe
    "C:\Users\Admin\AppData\Local\Temp\5617a17faab361c772af5ec1b640097706a850742cd0fe040784c1a49ada20eb.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:888
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rGBgAgwGRz.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1332
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rGBgAgwGRz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7B1B.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3792
    • C:\Users\Admin\AppData\Local\Temp\5617a17faab361c772af5ec1b640097706a850742cd0fe040784c1a49ada20eb.exe
      "C:\Users\Admin\AppData\Local\Temp\5617a17faab361c772af5ec1b640097706a850742cd0fe040784c1a49ada20eb.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2272

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ffmzrsas.bwt.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmp7B1B.tmp

          Filesize

          1KB

          MD5

          a4ff1884cd7821199f93d9e6f9b62481

          SHA1

          54f1b37ba06ecb6bfec7e8012dce8a3d441480d8

          SHA256

          94fd22d3538b4c5475c14ea264493ac5d8493a09c63d7dc56400d7466f16d230

          SHA512

          40cb2f90debb99902e1775c0eb6cd7c68633fa7d97f565f73bf5535ff0ba223f1abddc941238f7ced21d806b2a83c8d8fed0e33a70451e9e93431334bcbbf6f1

        • memory/888-6-0x0000000006310000-0x0000000006332000-memory.dmp

          Filesize

          136KB

        • memory/888-3-0x0000000005140000-0x00000000051D2000-memory.dmp

          Filesize

          584KB

        • memory/888-4-0x00000000052E0000-0x00000000052EA000-memory.dmp

          Filesize

          40KB

        • memory/888-5-0x0000000074D90000-0x0000000075540000-memory.dmp

          Filesize

          7.7MB

        • memory/888-2-0x00000000056F0000-0x0000000005C94000-memory.dmp

          Filesize

          5.6MB

        • memory/888-7-0x0000000006620000-0x000000000662C000-memory.dmp

          Filesize

          48KB

        • memory/888-8-0x00000000010E0000-0x00000000010F0000-memory.dmp

          Filesize

          64KB

        • memory/888-9-0x000000000D080000-0x000000000D102000-memory.dmp

          Filesize

          520KB

        • memory/888-10-0x0000000010830000-0x00000000108CC000-memory.dmp

          Filesize

          624KB

        • memory/888-37-0x0000000074D90000-0x0000000075540000-memory.dmp

          Filesize

          7.7MB

        • memory/888-0-0x0000000074D9E000-0x0000000074D9F000-memory.dmp

          Filesize

          4KB

        • memory/888-1-0x00000000007C0000-0x0000000000878000-memory.dmp

          Filesize

          736KB

        • memory/1332-31-0x00000000061C0000-0x0000000006514000-memory.dmp

          Filesize

          3.3MB

        • memory/1332-51-0x0000000006DC0000-0x0000000006DDE000-memory.dmp

          Filesize

          120KB

        • memory/1332-27-0x0000000006150000-0x00000000061B6000-memory.dmp

          Filesize

          408KB

        • memory/1332-17-0x0000000005880000-0x0000000005EA8000-memory.dmp

          Filesize

          6.2MB

        • memory/1332-65-0x0000000074D90000-0x0000000075540000-memory.dmp

          Filesize

          7.7MB

        • memory/1332-28-0x0000000074D90000-0x0000000075540000-memory.dmp

          Filesize

          7.7MB

        • memory/1332-16-0x0000000074D90000-0x0000000075540000-memory.dmp

          Filesize

          7.7MB

        • memory/1332-23-0x00000000060E0000-0x0000000006146000-memory.dmp

          Filesize

          408KB

        • memory/1332-20-0x0000000005800000-0x0000000005822000-memory.dmp

          Filesize

          136KB

        • memory/1332-62-0x0000000007E80000-0x0000000007E88000-memory.dmp

          Filesize

          32KB

        • memory/1332-15-0x00000000051E0000-0x0000000005216000-memory.dmp

          Filesize

          216KB

        • memory/1332-38-0x0000000006840000-0x000000000685E000-memory.dmp

          Filesize

          120KB

        • memory/1332-39-0x0000000006DF0000-0x0000000006E3C000-memory.dmp

          Filesize

          304KB

        • memory/1332-41-0x0000000075640000-0x000000007568C000-memory.dmp

          Filesize

          304KB

        • memory/1332-40-0x0000000007A00000-0x0000000007A32000-memory.dmp

          Filesize

          200KB

        • memory/1332-19-0x0000000074D90000-0x0000000075540000-memory.dmp

          Filesize

          7.7MB

        • memory/1332-52-0x0000000007A40000-0x0000000007AE3000-memory.dmp

          Filesize

          652KB

        • memory/1332-53-0x00000000081A0000-0x000000000881A000-memory.dmp

          Filesize

          6.5MB

        • memory/1332-54-0x0000000007B60000-0x0000000007B7A000-memory.dmp

          Filesize

          104KB

        • memory/1332-61-0x0000000007EA0000-0x0000000007EBA000-memory.dmp

          Filesize

          104KB

        • memory/1332-56-0x0000000007BD0000-0x0000000007BDA000-memory.dmp

          Filesize

          40KB

        • memory/1332-57-0x0000000007DE0000-0x0000000007E76000-memory.dmp

          Filesize

          600KB

        • memory/1332-58-0x0000000007D60000-0x0000000007D71000-memory.dmp

          Filesize

          68KB

        • memory/1332-59-0x0000000007D90000-0x0000000007D9E000-memory.dmp

          Filesize

          56KB

        • memory/1332-60-0x0000000007DA0000-0x0000000007DB4000-memory.dmp

          Filesize

          80KB

        • memory/2272-55-0x0000000006470000-0x00000000064C0000-memory.dmp

          Filesize

          320KB

        • memory/2272-36-0x0000000074D90000-0x0000000075540000-memory.dmp

          Filesize

          7.7MB

        • memory/2272-29-0x0000000000400000-0x0000000000440000-memory.dmp

          Filesize

          256KB

        • memory/2272-66-0x0000000074D90000-0x0000000075540000-memory.dmp

          Filesize

          7.7MB