Analysis
- max time kernel
129s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
07/06/2024, 01:17
General
- Target 8fbf89ff9f1c63329f5251feed90590b8f3bd725e469b5afd25be717f3cb2ca9.exe
- Size 684KB
- Sample240607-bnl2nsfa61
- SHA256 8fbf89ff9f1c63329f5251feed90590b8f3bd725e469b5afd25be717f3cb2ca9
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.springandsummer.lk
-
Port
587
-
Username
-
Password
anu##323
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fbf89ff9f1c63329f5251feed90590b8f3bd725e469b5afd25be717f3cb2ca9.exe"C:\Users\Admin\AppData\Local\Temp\8fbf89ff9f1c63329f5251feed90590b8f3bd725e469b5afd25be717f3cb2ca9.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8fbf89ff9f1c63329f5251feed90590b8f3bd725e469b5afd25be717f3cb2ca9.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYctFdAIXtTSr.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYctFdAIXtTSr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpACBB.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
__PSScriptPolicyTest_ns4koo0j.bem.ps1
tmpACBB.tmp
memory/1376-74-0x0000000007B90000-0x000000000820A000-memory.dmp
memory/1376-82-0x0000000007880000-0x000000000789A000-memory.dmp
memory/1376-81-0x0000000007780000-0x0000000007794000-memory.dmp
memory/1376-78-0x0000000007740000-0x0000000007751000-memory.dmp
memory/1376-52-0x0000000070CD0000-0x0000000070D1C000-memory.dmp
memory/1376-28-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/1376-72-0x0000000007390000-0x00000000073AE000-memory.dmp
memory/1376-51-0x00000000073D0000-0x0000000007402000-memory.dmp
memory/1376-39-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/1376-88-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/1376-26-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/2080-21-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2080-90-0x00000000062E0000-0x0000000006330000-memory.dmp
memory/3052-75-0x0000000007940000-0x000000000795A000-memory.dmp
memory/3052-22-0x00000000055E0000-0x0000000005602000-memory.dmp
memory/3052-24-0x0000000005EF0000-0x0000000005F56000-memory.dmp
memory/3052-89-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/3052-20-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/3052-17-0x0000000005750000-0x0000000005D78000-memory.dmp
memory/3052-18-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/3052-38-0x0000000005F60000-0x00000000062B4000-memory.dmp
memory/3052-15-0x0000000005050000-0x0000000005086000-memory.dmp
memory/3052-76-0x00000000079C0000-0x00000000079CA000-memory.dmp
memory/3052-83-0x0000000007C60000-0x0000000007C68000-memory.dmp
memory/3052-49-0x0000000006600000-0x000000000661E000-memory.dmp
memory/3052-50-0x0000000006B80000-0x0000000006BCC000-memory.dmp
memory/3052-80-0x0000000007B70000-0x0000000007B7E000-memory.dmp
memory/3052-73-0x0000000007600000-0x00000000076A3000-memory.dmp
memory/3052-23-0x0000000005D80000-0x0000000005DE6000-memory.dmp
memory/3052-57-0x0000000070CD0000-0x0000000070D1C000-memory.dmp
memory/3052-77-0x0000000007BC0000-0x0000000007C56000-memory.dmp
memory/4084-9-0x0000000005D30000-0x0000000005DB2000-memory.dmp
memory/4084-8-0x0000000005CD0000-0x0000000005CE0000-memory.dmp
memory/4084-7-0x0000000005CB0000-0x0000000005CBE000-memory.dmp
memory/4084-0-0x000000007463E000-0x000000007463F000-memory.dmp
memory/4084-6-0x0000000006410000-0x0000000006426000-memory.dmp
memory/4084-10-0x00000000087F0000-0x000000000888C000-memory.dmp
memory/4084-5-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/4084-4-0x0000000004AC0000-0x0000000004ACA000-memory.dmp
memory/4084-16-0x000000007463E000-0x000000007463F000-memory.dmp
memory/4084-27-0x0000000074630000-0x0000000074DE0000-memory.dmp
memory/4084-3-0x0000000004B40000-0x0000000004BD2000-memory.dmp
memory/4084-2-0x00000000050F0000-0x0000000005694000-memory.dmp
memory/4084-1-0x0000000000150000-0x00000000001FE000-memory.dmp