Analysis
- max time kernel
141s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
01/06/2024, 01:54
General
- Target AWB#7490327845.exe
- Size 766KB
- Sample240601-cbzyfadg51
- SHA256 b21e59afbee71be1a68fced4c55be91b15648c96282f8667323119e9cb44938b
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
marcellinus360
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AWB#7490327845.exe"C:\Users\Admin\AppData\Local\Temp\AWB#7490327845.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\AWB#7490327845.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qpQfYTfeO.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qpQfYTfeO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp56B6.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_yb3t15ic.lhv.ps1
tmp56B6.tmp
memory/1720-49-0x0000000005110000-0x000000000512E000-memory.dmp
memory/1720-90-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/1720-80-0x0000000007910000-0x000000000791E000-memory.dmp
memory/1720-75-0x00000000076E0000-0x00000000076FA000-memory.dmp
memory/1720-74-0x0000000007D20000-0x000000000839A000-memory.dmp
memory/1720-83-0x0000000007A00000-0x0000000007A08000-memory.dmp
memory/1720-63-0x0000000007590000-0x0000000007633000-memory.dmp
memory/1720-15-0x0000000002A70000-0x0000000002AA6000-memory.dmp
memory/1720-16-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/1720-17-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/1720-18-0x00000000055F0000-0x0000000005C18000-memory.dmp
memory/1720-62-0x0000000006950000-0x000000000696E000-memory.dmp
memory/1720-20-0x0000000005C20000-0x0000000005C42000-memory.dmp
memory/1720-52-0x0000000070E60000-0x0000000070EAC000-memory.dmp
memory/1720-23-0x0000000005D30000-0x0000000005D96000-memory.dmp
memory/1720-22-0x0000000005CC0000-0x0000000005D26000-memory.dmp
memory/1720-51-0x0000000006990000-0x00000000069C2000-memory.dmp
memory/1720-50-0x0000000006460000-0x00000000064AC000-memory.dmp
memory/1720-78-0x0000000007960000-0x00000000079F6000-memory.dmp
memory/1720-38-0x0000000005DA0000-0x00000000060F4000-memory.dmp
memory/2964-21-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/2964-1-0x0000000000A40000-0x0000000000B06000-memory.dmp
memory/2964-39-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/2964-2-0x0000000007F50000-0x00000000084F4000-memory.dmp
memory/2964-5-0x00000000079E0000-0x00000000079EA000-memory.dmp
memory/2964-3-0x0000000007A40000-0x0000000007AD2000-memory.dmp
memory/2964-0-0x00000000747CE000-0x00000000747CF000-memory.dmp
memory/2964-4-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/2964-10-0x000000000DF40000-0x000000000DFDC000-memory.dmp
memory/2964-9-0x00000000747CE000-0x00000000747CF000-memory.dmp
memory/2964-8-0x000000000A990000-0x000000000AA12000-memory.dmp
memory/2964-7-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/2964-6-0x0000000002E00000-0x0000000002E18000-memory.dmp
memory/3380-37-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/3380-77-0x00000000079B0000-0x00000000079BA000-memory.dmp
memory/3380-79-0x0000000007B40000-0x0000000007B51000-memory.dmp
memory/3380-81-0x0000000007B80000-0x0000000007B94000-memory.dmp
memory/3380-82-0x0000000007C80000-0x0000000007C9A000-memory.dmp
memory/3380-64-0x0000000070E60000-0x0000000070EAC000-memory.dmp
memory/3380-30-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/3380-89-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/3380-24-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/3448-76-0x0000000006500000-0x0000000006550000-memory.dmp
memory/3448-35-0x0000000000400000-0x0000000000440000-memory.dmp