Analysis
- max time kernel
143s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
07/06/2024, 08:15
General
- Target Roundcube account_New_activities_June_06_24___eml.exe
- Size 1.3MB
- Sample240607-j5kh6sec76
- SHA256 5f3b37688eecd92c1ef6fee755f65bc758972a260e74986407e7e7c51dcb5276
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Roundcube account_New_activities_June_06_24___eml.exe"C:\Users\Admin\AppData\Local\Temp\Roundcube account_New_activities_June_06_24___eml.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\troopwise\antholite.exe"C:\Users\Admin\AppData\Local\Temp\Roundcube account_New_activities_June_06_24___eml.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Roundcube account_New_activities_June_06_24___eml.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3760 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
antholite.exe
memory/4196-28-0x0000000000400000-0x0000000000447000-memory.dmp
memory/4196-29-0x0000000000400000-0x0000000000447000-memory.dmp
memory/4196-30-0x0000000000400000-0x0000000000447000-memory.dmp
memory/4196-31-0x0000000000400000-0x0000000000447000-memory.dmp
memory/4196-32-0x000000007456E000-0x000000007456F000-memory.dmp
memory/4196-33-0x0000000003240000-0x0000000003296000-memory.dmp
memory/4196-34-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/4196-35-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/4196-36-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/4196-37-0x0000000005EB0000-0x0000000006454000-memory.dmp
memory/4196-38-0x00000000057C0000-0x0000000005814000-memory.dmp
memory/4196-46-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-94-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-98-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-96-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-92-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-88-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-86-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-85-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-82-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-78-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-74-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-72-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-70-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-68-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-66-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-65-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-62-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-58-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-56-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-54-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-53-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-50-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-44-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-42-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-40-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-39-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-90-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-80-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-76-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-60-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-48-0x00000000057C0000-0x000000000580F000-memory.dmp
memory/4196-1133-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/4196-1134-0x0000000005A00000-0x0000000005A66000-memory.dmp
memory/4196-1135-0x0000000000400000-0x0000000000447000-memory.dmp
memory/4196-1136-0x000000007456E000-0x000000007456F000-memory.dmp
memory/4196-1137-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/4196-1138-0x0000000006E40000-0x0000000006E90000-memory.dmp
memory/4196-1139-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/4196-1140-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/4196-1141-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/5080-10-0x0000000004140000-0x0000000004144000-memory.dmp