Analysis
- max time kernel
153s - max time network
162s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
07/06/2024, 01:23
General
- Target 25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f.exe
- Size 758KB
- Sample240607-brscvsfb4y
- SHA256 25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
sslout.de
-
Port
587
-
Username
-
Password
dataset123
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f.exe"C:\Users\Admin\AppData\Local\Temp\25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Eudaemonia=Get-Content 'C:\Users\Admin\AppData\Local\Temp\auf\utryktes.Sub';$Emballage=$Eudaemonia.SubString(44370,3);.$Emballage($Eudaemonia)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"3⤵
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_hq5ex3il.u4b.ps1
Anomalien.Frf
utryktes.Sub
memory/1564-199-0x0000000024B40000-0x0000000024B4A000-memory.dmp
memory/1564-198-0x0000000025210000-0x00000000252A2000-memory.dmp
memory/1564-197-0x0000000024AF0000-0x0000000024B40000-memory.dmp
memory/1564-195-0x0000000001200000-0x0000000001242000-memory.dmp
memory/1564-194-0x0000000001200000-0x0000000002454000-memory.dmp
memory/2368-177-0x0000000007A40000-0x0000000007FE4000-memory.dmp
memory/2368-183-0x0000000073A3E000-0x0000000073A3F000-memory.dmp
memory/2368-171-0x0000000006490000-0x00000000064AE000-memory.dmp
memory/2368-172-0x0000000006520000-0x000000000656C000-memory.dmp
memory/2368-173-0x0000000073A30000-0x00000000741E0000-memory.dmp
memory/2368-174-0x0000000006960000-0x00000000069F6000-memory.dmp
memory/2368-176-0x0000000006A30000-0x0000000006A52000-memory.dmp
memory/2368-175-0x0000000006910000-0x000000000692A000-memory.dmp
memory/2368-153-0x0000000073A3E000-0x0000000073A3F000-memory.dmp
memory/2368-160-0x0000000005E20000-0x0000000005E86000-memory.dmp
memory/2368-179-0x0000000008670000-0x0000000008CEA000-memory.dmp
memory/2368-181-0x0000000073A30000-0x00000000741E0000-memory.dmp
memory/2368-159-0x0000000005DB0000-0x0000000005E16000-memory.dmp
memory/2368-166-0x0000000005E90000-0x00000000061E4000-memory.dmp
memory/2368-184-0x0000000073A30000-0x00000000741E0000-memory.dmp
memory/2368-185-0x0000000073A30000-0x00000000741E0000-memory.dmp
memory/2368-187-0x0000000073A30000-0x00000000741E0000-memory.dmp
memory/2368-188-0x0000000073A30000-0x00000000741E0000-memory.dmp
memory/2368-189-0x0000000008CF0000-0x000000000CEEE000-memory.dmp
memory/2368-190-0x0000000073A30000-0x00000000741E0000-memory.dmp
memory/2368-158-0x0000000005430000-0x0000000005452000-memory.dmp
memory/2368-157-0x0000000005610000-0x0000000005C38000-memory.dmp
memory/2368-156-0x0000000073A30000-0x00000000741E0000-memory.dmp
memory/2368-154-0x0000000073A30000-0x00000000741E0000-memory.dmp
memory/2368-155-0x0000000004E40000-0x0000000004E76000-memory.dmp