Analysis
- max time kernel
137s - max time network
162s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
21/05/2024, 07:08
General
- Target URGENT REQUEST FOR QUOTATION.exe
- Size 673KB
- Sample240521-hydllscd25
- SHA256 8fb777d3216834be1787eb6b32f538983ba82ce75af5925d714036f8d70a2914
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.springandsummer.lk
-
Port
587
-
Username
-
Password
anu##323
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\URGENT REQUEST FOR QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\URGENT REQUEST FOR QUOTATION.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\URGENT REQUEST FOR QUOTATION.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sYntCeaVlYgp.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sYntCeaVlYgp" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC6E5.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_t3sfskj2.hwl.ps1
tmpC6E5.tmp
memory/3044-77-0x00000000062A0000-0x00000000062F0000-memory.dmp
memory/3044-28-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3844-14-0x0000000074F00000-0x00000000756B0000-memory.dmp
memory/3844-26-0x0000000005D40000-0x0000000005DA6000-memory.dmp
memory/3844-89-0x0000000074F00000-0x00000000756B0000-memory.dmp
memory/3844-86-0x0000000007B20000-0x0000000007B28000-memory.dmp
memory/3844-84-0x0000000007A40000-0x0000000007A54000-memory.dmp
memory/3844-82-0x0000000007A00000-0x0000000007A11000-memory.dmp
memory/3844-79-0x0000000007800000-0x000000000781A000-memory.dmp
memory/3844-78-0x0000000007E50000-0x00000000084CA000-memory.dmp
memory/3844-27-0x0000000005E60000-0x0000000005EC6000-memory.dmp
memory/3844-15-0x0000000002C00000-0x0000000002C36000-memory.dmp
memory/3844-16-0x0000000074F00000-0x00000000756B0000-memory.dmp
memory/3844-17-0x0000000074F00000-0x00000000756B0000-memory.dmp
memory/3844-19-0x0000000005710000-0x0000000005D38000-memory.dmp
memory/3844-75-0x0000000006AA0000-0x0000000006ABE000-memory.dmp
memory/3844-55-0x00000000715D0000-0x000000007161C000-memory.dmp
memory/3844-54-0x00000000074A0000-0x00000000074D2000-memory.dmp
memory/3844-51-0x00000000064E0000-0x00000000064FE000-memory.dmp
memory/3844-50-0x0000000005ED0000-0x0000000006224000-memory.dmp
memory/4656-76-0x00000000075B0000-0x0000000007653000-memory.dmp
memory/4656-80-0x0000000007760000-0x000000000776A000-memory.dmp
memory/4656-90-0x0000000074F00000-0x00000000756B0000-memory.dmp
memory/4656-85-0x0000000007A30000-0x0000000007A4A000-memory.dmp
memory/4656-83-0x0000000007920000-0x000000000792E000-memory.dmp
memory/4656-25-0x00000000053F0000-0x0000000005412000-memory.dmp
memory/4656-49-0x0000000005ED0000-0x0000000006224000-memory.dmp
memory/4656-23-0x0000000074F00000-0x00000000756B0000-memory.dmp
memory/4656-52-0x0000000006740000-0x000000000678C000-memory.dmp
memory/4656-81-0x0000000007970000-0x0000000007A06000-memory.dmp
memory/4656-56-0x00000000715D0000-0x000000007161C000-memory.dmp
memory/4656-22-0x0000000074F00000-0x00000000756B0000-memory.dmp
memory/4656-21-0x0000000074F00000-0x00000000756B0000-memory.dmp
memory/5016-0-0x0000000074F0E000-0x0000000074F0F000-memory.dmp
memory/5016-1-0x0000000000130000-0x00000000001DA000-memory.dmp
memory/5016-11-0x0000000074F00000-0x00000000756B0000-memory.dmp
memory/5016-10-0x0000000074F0E000-0x0000000074F0F000-memory.dmp
memory/5016-3-0x0000000004BD0000-0x0000000004C62000-memory.dmp
memory/5016-4-0x0000000074F00000-0x00000000756B0000-memory.dmp
memory/5016-9-0x0000000006650000-0x00000000066D4000-memory.dmp
memory/5016-2-0x0000000005180000-0x0000000005724000-memory.dmp
memory/5016-8-0x0000000004E60000-0x0000000004E70000-memory.dmp
memory/5016-5-0x0000000004D60000-0x0000000004D6A000-memory.dmp
memory/5016-7-0x0000000004F30000-0x0000000004F4A000-memory.dmp
memory/5016-6-0x0000000004E70000-0x0000000004F0C000-memory.dmp
memory/5016-48-0x0000000074F00000-0x00000000756B0000-memory.dmp