Resubmissions
30/05/2024, 19:37
240530-yb51caaa721030/05/2024, 19:37
240530-ybvjlsaa661030/05/2024, 19:28
240530-x6yzvage9v10Analysis
- max time kernel
1189s - max time network
1174s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
30/05/2024, 19:37
General
- Target REVISED_CONTRACTS_20240530_JPG.iso
- Size 1.2MB
- Sample240530-yb51caaa72
- SHA256 2257d944da170e137135312489c2f9f017741734df13956506848c2852641905
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.instantprint.ro
-
Port
21
-
Username
-
Password
playmen123#@
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Loads dropped DLL 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\REVISED_CONTRACTS_20240530_JPG.iso1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
\??\E:\REVISED_CONTRACTS_20240530_JPG.bat"E:\REVISED_CONTRACTS_20240530_JPG.bat"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
\??\E:\REVISED_CONTRACTS_20240530_JPG.bat"E:\REVISED_CONTRACTS_20240530_JPG.bat"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
System.dll
memory/1396-11-0x0000000004B90000-0x00000000077CA000-memory.dmp
memory/1396-12-0x0000000010004000-0x0000000010005000-memory.dmp
memory/1396-17-0x0000000004B90000-0x00000000077CA000-memory.dmp
memory/4708-16-0x00000000004B0000-0x0000000001704000-memory.dmp
memory/4708-18-0x00000000004B0000-0x00000000004F2000-memory.dmp
memory/4708-19-0x0000000036E40000-0x00000000373E4000-memory.dmp
memory/4708-20-0x0000000037620000-0x0000000037686000-memory.dmp
memory/4708-22-0x0000000037EB0000-0x0000000037F00000-memory.dmp
memory/4708-23-0x0000000037F10000-0x0000000037FA2000-memory.dmp
memory/4708-24-0x0000000037FD0000-0x0000000037FDA000-memory.dmp