Analysis
- max time kernel
21s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
07/06/2024, 01:56
General
- Target MT25QL128ABA1EW7-0SIT - Micron.exe
- Size 903KB
- Sample240607-cc17wsgh22
- SHA256 ce45391f81f68e4bd77aff84b26082ed86a7be5a2e1003e4d8ff8ef7763b9d9a
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.medicalhome.com.pe
-
Port
587
-
Username
-
Password
MHinfo01
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
- Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
- Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
- Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\MT25QL128ABA1EW7-0SIT - Micron.exe"C:\Users\Admin\AppData\Local\Temp\MT25QL128ABA1EW7-0SIT - Micron.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\MT25QL128ABA1EW7-0SIT - Micron.exe"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\MT25QL128ABA1EW7-0SIT - Micron.exe"C:\Users\Admin\AppData\Local\Temp\MT25QL128ABA1EW7-0SIT - Micron.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
MT25QL128ABA1EW7-0SIT - Micron.exe.log
__PSScriptPolicyTest_d4bkxcso.eww.ps1
memory/3816-35-0x0000000075080000-0x0000000075830000-memory.dmp
memory/3816-36-0x00000000060D0000-0x00000000060EE000-memory.dmp
memory/3816-64-0x0000000075080000-0x0000000075830000-memory.dmp
memory/3816-59-0x0000000007630000-0x0000000007644000-memory.dmp
memory/3816-61-0x0000000007710000-0x0000000007718000-memory.dmp
memory/3816-60-0x0000000007730000-0x000000000774A000-memory.dmp
memory/3816-58-0x0000000007620000-0x000000000762E000-memory.dmp
memory/3816-55-0x00000000075F0000-0x0000000007601000-memory.dmp
memory/3816-54-0x0000000007670000-0x0000000007706000-memory.dmp
memory/3816-53-0x0000000007460000-0x000000000746A000-memory.dmp
memory/3816-51-0x0000000007A40000-0x00000000080BA000-memory.dmp
memory/3816-17-0x00000000027E0000-0x0000000002816000-memory.dmp
memory/3816-19-0x00000000052A0000-0x00000000058C8000-memory.dmp
memory/3816-20-0x0000000075080000-0x0000000075830000-memory.dmp
memory/3816-52-0x00000000073F0000-0x000000000740A000-memory.dmp
memory/3816-39-0x0000000070CE0000-0x0000000070D2C000-memory.dmp
memory/3816-49-0x00000000066A0000-0x00000000066BE000-memory.dmp
memory/3816-21-0x0000000005940000-0x0000000005962000-memory.dmp
memory/3816-34-0x0000000075080000-0x0000000075830000-memory.dmp
memory/3816-22-0x00000000059E0000-0x0000000005A46000-memory.dmp
memory/3816-50-0x00000000072D0000-0x0000000007373000-memory.dmp
memory/3816-38-0x0000000007290000-0x00000000072C2000-memory.dmp
memory/3816-33-0x0000000005AC0000-0x0000000005E14000-memory.dmp
memory/3816-37-0x0000000006630000-0x000000000667C000-memory.dmp
memory/4040-7-0x0000000005740000-0x000000000574E000-memory.dmp
memory/4040-9-0x00000000066F0000-0x00000000067A8000-memory.dmp
memory/4040-4-0x0000000005470000-0x000000000547A000-memory.dmp
memory/4040-10-0x0000000009230000-0x00000000092CC000-memory.dmp
memory/4040-3-0x00000000054C0000-0x0000000005552000-memory.dmp
memory/4040-1-0x0000000000980000-0x0000000000A64000-memory.dmp
memory/4040-5-0x0000000075080000-0x0000000075830000-memory.dmp
memory/4040-15-0x0000000075080000-0x0000000075830000-memory.dmp
memory/4040-14-0x000000007508E000-0x000000007508F000-memory.dmp
memory/4040-6-0x0000000005720000-0x0000000005736000-memory.dmp
memory/4040-0-0x000000007508E000-0x000000007508F000-memory.dmp
memory/4040-2-0x00000000059D0000-0x0000000005F74000-memory.dmp
memory/4040-8-0x0000000006690000-0x00000000066A0000-memory.dmp
memory/4984-18-0x0000000005320000-0x0000000005386000-memory.dmp
memory/4984-16-0x0000000075080000-0x0000000075830000-memory.dmp
memory/4984-23-0x0000000075080000-0x0000000075830000-memory.dmp
memory/4984-11-0x0000000000400000-0x0000000000476000-memory.dmp
memory/4984-65-0x00000000068A0000-0x00000000068F0000-memory.dmp
memory/4984-66-0x0000000075080000-0x0000000075830000-memory.dmp