Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 06:43
Static task
static1
Behavioral task
behavioral1
Sample
doc0029388484859996.bat.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
doc0029388484859996.bat.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
General
-
Target
doc0029388484859996.bat.exe
-
Size
520KB
-
MD5
a3b9350d1b3df23db1b51c290b4af29d
-
SHA1
81a32852f02c2602f3c60094fe7c339225fc115b
-
SHA256
5046cb3e7954bc8bc9c76603bb1be13d3e1839cb57b5fbcad1e0008d0aa2e5e3
-
SHA512
c39a2004db216d4851a7a06bc4916ce23e3c74d164c127440b38e8d7e1c4525d332790fd0d6137a8956d7efae1f6320862d84d3dc07673f6e43edb34ea23d9c7
-
SSDEEP
12288:karCpZAGA6yYsKAtOw+Qe4NigsmhhygoRu6X1:1rozA6z0t+Qe4vsYySG1
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.dachangshelving.id - Port:
21 - Username:
[email protected] - Password:
boygirl123456
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Loads dropped DLL 1 IoCs
Processes:
doc0029388484859996.bat.exepid process 1712 doc0029388484859996.bat.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 ip-api.com -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
doc0029388484859996.bat.exepid process 2732 doc0029388484859996.bat.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
doc0029388484859996.bat.exedoc0029388484859996.bat.exepid process 1712 doc0029388484859996.bat.exe 2732 doc0029388484859996.bat.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
doc0029388484859996.bat.exedescription pid process target process PID 1712 set thread context of 2732 1712 doc0029388484859996.bat.exe doc0029388484859996.bat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
doc0029388484859996.bat.exepid process 2732 doc0029388484859996.bat.exe 2732 doc0029388484859996.bat.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
doc0029388484859996.bat.exepid process 1712 doc0029388484859996.bat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
doc0029388484859996.bat.exedescription pid process Token: SeDebugPrivilege 2732 doc0029388484859996.bat.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
doc0029388484859996.bat.exedescription pid process target process PID 1712 wrote to memory of 2732 1712 doc0029388484859996.bat.exe doc0029388484859996.bat.exe PID 1712 wrote to memory of 2732 1712 doc0029388484859996.bat.exe doc0029388484859996.bat.exe PID 1712 wrote to memory of 2732 1712 doc0029388484859996.bat.exe doc0029388484859996.bat.exe PID 1712 wrote to memory of 2732 1712 doc0029388484859996.bat.exe doc0029388484859996.bat.exe PID 1712 wrote to memory of 2732 1712 doc0029388484859996.bat.exe doc0029388484859996.bat.exe PID 1712 wrote to memory of 2732 1712 doc0029388484859996.bat.exe doc0029388484859996.bat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\doc0029388484859996.bat.exe"C:\Users\Admin\AppData\Local\Temp\doc0029388484859996.bat.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\doc0029388484859996.bat.exe"C:\Users\Admin\AppData\Local\Temp\doc0029388484859996.bat.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\rasterside.iniFilesize
39B
MD5dc764daea004e907e2a4076dc2e81dce
SHA164cc2f14c8426031e8fe9995da24887ff5beec97
SHA2568a3dd54acac47298afa45e7048a9297f897e35cb351e511fbe5a421b1ed6523d
SHA512f03e8c65e1974e8bc1608e292a9898054c791b5e8505b8bbd5f9eb832cd414c3fb19f7e328286984cc73a07937d60731dd00f20c3e31db77245a2f178e5bf257
-
\Users\Admin\AppData\Local\Temp\nso2251.tmp\System.dllFilesize
11KB
MD5fbe295e5a1acfbd0a6271898f885fe6a
SHA1d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA256a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
SHA5122cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
-
memory/1712-41-0x00000000772B1000-0x00000000773B2000-memory.dmpFilesize
1.0MB
-
memory/1712-42-0x00000000772B0000-0x0000000077459000-memory.dmpFilesize
1.7MB
-
memory/2732-43-0x00000000772B0000-0x0000000077459000-memory.dmpFilesize
1.7MB
-
memory/2732-44-0x0000000000470000-0x00000000014D2000-memory.dmpFilesize
16.4MB
-
memory/2732-45-0x0000000000470000-0x00000000014D2000-memory.dmpFilesize
16.4MB
-
memory/2732-46-0x0000000000470000-0x00000000004B2000-memory.dmpFilesize
264KB