Analysis
- max time kernel
0s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
07/06/2024, 01:41
General
- Target 618b33a72f9144d36da3ed9e1b84069bf996821512d8ab30297da3bea81633c5.vbs
- Size 2.0MB
- Sample240607-b37a6agf36
- SHA256 618b33a72f9144d36da3ed9e1b84069bf996821512d8ab30297da3bea81633c5
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.astramedikal.com
-
Port
587
-
Username
-
Password
muhasebe2020*
Extracted
-
xworm
-
5.0
-
etZTVSwBlveCYECe
-
install_file
USB.exe
-
pastebin_url
https://pastebin.com/raw/Msa6vJjt
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.astramedikal.com
-
Port
587
-
Username
-
Password
muhasebe2020*
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect Xworm Payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Detect packed .NET executables. Mostly AgentTeslaV4. 2 IoCs
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs
- Detects executables referencing Windows vault credential objects. Observed in infostealers 2 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs
- Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs
- Detects executables referencing many file transfer clients. Observed in information stealers 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Delays execution with timeout.exe 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\618b33a72f9144d36da3ed9e1b84069bf996821512d8ab30297da3bea81633c5.vbs"1⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\x.exe"C:\Users\Admin\AppData\Local\Temp\x.exe"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "x" /t REG_SZ /F /D "C:\Users\Admin\Documents\x.pif"3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "x" /t REG_SZ /F /D "C:\Users\Admin\Documents\x.pif"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c Copy "C:\Users\Admin\AppData\Local\Temp\x.exe" "C:\Users\Admin\Documents\x.pif"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\x.exe"C:\Users\Admin\AppData\Local\Temp\x.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\niqgjn.exe"C:\Users\Admin\AppData\Local\Temp\niqgjn.exe"4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC832.tmp.bat""4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
x.exe.log
niqgjn.exe
tmpC832.tmp.bat
x.exe
memory/2652-24-0x0000000000400000-0x000000000040E000-memory.dmp
memory/3896-47-0x0000000006BA0000-0x0000000006BF0000-memory.dmp
memory/3896-45-0x0000000000C30000-0x0000000000C74000-memory.dmp
memory/4012-15-0x00000000749D0000-0x0000000075180000-memory.dmp
memory/4012-18-0x0000000006CB0000-0x0000000006CCE000-memory.dmp
memory/4012-19-0x0000000006D10000-0x0000000006D6A000-memory.dmp
memory/4012-21-0x0000000006FC0000-0x0000000007026000-memory.dmp
memory/4012-20-0x0000000006F20000-0x0000000006FBC000-memory.dmp
memory/4012-16-0x0000000004C50000-0x0000000004C5A000-memory.dmp
memory/4012-26-0x00000000749DE000-0x00000000749DF000-memory.dmp
memory/4012-28-0x00000000749D0000-0x0000000075180000-memory.dmp
memory/4012-17-0x0000000004F30000-0x0000000004FA6000-memory.dmp
memory/4012-13-0x00000000051A0000-0x0000000005744000-memory.dmp
memory/4012-14-0x0000000004C90000-0x0000000004D22000-memory.dmp
memory/4012-12-0x0000000000390000-0x000000000039A000-memory.dmp
memory/4012-11-0x00000000749DE000-0x00000000749DF000-memory.dmp