Analysis
- max time kernel
134s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
04/06/2024, 11:24
General
- Target Financial Invoice Report - STI ME-3051-2024.exe
- Size 687KB
- Sample240604-nhpxlafa35
- SHA256 6f4fe5f02ccbea743f38c50e8876c145db647247654ee55031e42682fa8ef6da
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
sg2plcpnl0128.prod.sin2.secureserver.net
-
Port
587
-
Username
-
Password
oc27-JcbRAO~
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Financial Invoice Report - STI ME-3051-2024.exe"C:\Users\Admin\AppData\Local\Temp\Financial Invoice Report - STI ME-3051-2024.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Financial Invoice Report - STI ME-3051-2024.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TdbuEaJPu.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TdbuEaJPu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp21FA.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4328,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_zcilvtyg.25r.ps1
tmp21FA.tmp
memory/988-77-0x00000000072B0000-0x0000000007346000-memory.dmp
memory/988-79-0x0000000007260000-0x000000000726E000-memory.dmp
memory/988-81-0x0000000007370000-0x000000000738A000-memory.dmp
memory/988-76-0x00000000070A0000-0x00000000070AA000-memory.dmp
memory/988-73-0x0000000006D00000-0x0000000006DA3000-memory.dmp
memory/988-53-0x0000000070290000-0x00000000702DC000-memory.dmp
memory/988-46-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/988-26-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/988-89-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/988-24-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/1664-45-0x0000000000400000-0x0000000000442000-memory.dmp
memory/1664-90-0x0000000006470000-0x00000000064C0000-memory.dmp
memory/1724-88-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/1724-18-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/1724-17-0x0000000005530000-0x0000000005B58000-memory.dmp
memory/1724-25-0x0000000005B60000-0x0000000005EB4000-memory.dmp
memory/1724-16-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/1724-15-0x0000000002880000-0x00000000028B6000-memory.dmp
memory/1724-22-0x0000000005400000-0x0000000005466000-memory.dmp
memory/1724-20-0x00000000051F0000-0x0000000005212000-memory.dmp
memory/1724-78-0x00000000076E0000-0x00000000076F1000-memory.dmp
memory/1724-21-0x0000000005390000-0x00000000053F6000-memory.dmp
memory/1724-82-0x0000000007800000-0x0000000007808000-memory.dmp
memory/1724-50-0x0000000006710000-0x000000000675C000-memory.dmp
memory/1724-48-0x0000000006180000-0x000000000619E000-memory.dmp
memory/1724-68-0x0000000007160000-0x000000000717E000-memory.dmp
memory/1724-80-0x0000000007720000-0x0000000007734000-memory.dmp
memory/1724-19-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/1724-52-0x0000000070290000-0x00000000702DC000-memory.dmp
memory/1724-51-0x00000000071A0000-0x00000000071D2000-memory.dmp
memory/1724-75-0x00000000074E0000-0x00000000074FA000-memory.dmp
memory/1724-74-0x0000000007B30000-0x00000000081AA000-memory.dmp
memory/3008-7-0x0000000005EE0000-0x0000000005EEE000-memory.dmp
memory/3008-6-0x0000000005EB0000-0x0000000005EC6000-memory.dmp
memory/3008-8-0x0000000006100000-0x0000000006110000-memory.dmp
memory/3008-5-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/3008-9-0x0000000006D60000-0x0000000006DE2000-memory.dmp
memory/3008-4-0x0000000005A50000-0x0000000005A5A000-memory.dmp
memory/3008-49-0x0000000074D20000-0x00000000754D0000-memory.dmp
memory/3008-3-0x0000000005A80000-0x0000000005B12000-memory.dmp
memory/3008-2-0x0000000006130000-0x00000000066D4000-memory.dmp
memory/3008-10-0x000000000AB00000-0x000000000AB9C000-memory.dmp
memory/3008-1-0x0000000000FE0000-0x0000000001092000-memory.dmp
memory/3008-0-0x0000000074D2E000-0x0000000074D2F000-memory.dmp