Analysis
- max time kernel
123s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
07/06/2024, 01:51
General
- Target 7b49be821f82c0045d96a26ce306ee9a65c862f7311efddb54c30bcd27ad94bd.exe
- Size 717KB
- Sample240607-b9ybtsff8s
- SHA256 7b49be821f82c0045d96a26ce306ee9a65c862f7311efddb54c30bcd27ad94bd
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.iaa-airferight.com
-
Port
587
-
Username
-
Password
Asaprocky11
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
- Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
- Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
- Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b49be821f82c0045d96a26ce306ee9a65c862f7311efddb54c30bcd27ad94bd.exe"C:\Users\Admin\AppData\Local\Temp\7b49be821f82c0045d96a26ce306ee9a65c862f7311efddb54c30bcd27ad94bd.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7b49be821f82c0045d96a26ce306ee9a65c862f7311efddb54c30bcd27ad94bd.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KWwZbXu.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KWwZbXu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp84B1.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ok2csnvb.pda.ps1
tmp84B1.tmp
memory/3380-48-0x0000000074AE0000-0x0000000075290000-memory.dmp
memory/3380-2-0x0000000005830000-0x0000000005DD4000-memory.dmp
memory/3380-6-0x0000000005450000-0x0000000005466000-memory.dmp
memory/3380-8-0x00000000056A0000-0x00000000056B0000-memory.dmp
memory/3380-7-0x0000000005580000-0x000000000558E000-memory.dmp
memory/3380-9-0x0000000006510000-0x0000000006592000-memory.dmp
memory/3380-10-0x000000000A4A0000-0x000000000A53C000-memory.dmp
memory/3380-15-0x0000000074AEE000-0x0000000074AEF000-memory.dmp
memory/3380-0-0x0000000074AEE000-0x0000000074AEF000-memory.dmp
memory/3380-5-0x0000000074AE0000-0x0000000075290000-memory.dmp
memory/3380-4-0x00000000052A0000-0x00000000052AA000-memory.dmp
memory/3380-1-0x0000000000930000-0x00000000009E4000-memory.dmp
memory/3380-3-0x0000000005320000-0x00000000053B2000-memory.dmp
memory/3728-21-0x0000000005080000-0x00000000050A2000-memory.dmp
memory/3728-73-0x00000000064F0000-0x000000000650E000-memory.dmp
memory/3728-75-0x00000000078B0000-0x0000000007F2A000-memory.dmp
memory/3728-47-0x0000000074AE0000-0x0000000075290000-memory.dmp
memory/3728-26-0x0000000074AE0000-0x0000000075290000-memory.dmp
memory/3728-79-0x0000000007470000-0x0000000007481000-memory.dmp
memory/3728-23-0x00000000057D0000-0x0000000005836000-memory.dmp
memory/3728-25-0x00000000058D0000-0x0000000005C24000-memory.dmp
memory/3728-24-0x0000000074AE0000-0x0000000075290000-memory.dmp
memory/3728-22-0x0000000005760000-0x00000000057C6000-memory.dmp
memory/3728-89-0x0000000074AE0000-0x0000000075290000-memory.dmp
memory/3728-82-0x00000000075B0000-0x00000000075CA000-memory.dmp
memory/3728-83-0x0000000007590000-0x0000000007598000-memory.dmp
memory/3728-78-0x00000000074F0000-0x0000000007586000-memory.dmp
memory/3728-74-0x0000000006F50000-0x0000000006FF3000-memory.dmp
memory/3728-81-0x00000000074B0000-0x00000000074C4000-memory.dmp
memory/3728-53-0x0000000071180000-0x00000000711CC000-memory.dmp
memory/3820-37-0x0000000000400000-0x0000000000440000-memory.dmp
memory/3820-91-0x0000000006AE0000-0x0000000006B30000-memory.dmp
memory/5084-16-0x0000000002BB0000-0x0000000002BE6000-memory.dmp
memory/5084-54-0x0000000071180000-0x00000000711CC000-memory.dmp
memory/5084-77-0x0000000007820000-0x000000000782A000-memory.dmp
memory/5084-76-0x00000000077B0000-0x00000000077CA000-memory.dmp
memory/5084-52-0x0000000006A30000-0x0000000006A62000-memory.dmp
memory/5084-17-0x0000000005660000-0x0000000005C88000-memory.dmp
memory/5084-18-0x0000000074AE0000-0x0000000075290000-memory.dmp
memory/5084-80-0x00000000079E0000-0x00000000079EE000-memory.dmp
memory/5084-90-0x0000000074AE0000-0x0000000075290000-memory.dmp
memory/5084-19-0x0000000074AE0000-0x0000000075290000-memory.dmp
memory/5084-50-0x0000000006470000-0x000000000648E000-memory.dmp
memory/5084-51-0x0000000006500000-0x000000000654C000-memory.dmp
memory/5084-49-0x0000000074AE0000-0x0000000075290000-memory.dmp