Analysis

  • max time kernel
    21s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-06-2024 01:54

General

  • Target

    STATEMENT OF ACCOUNT.exe

  • Size

    693KB

  • MD5

    c63d59194d1f0735dacda6ae00f46420

  • SHA1

    1132adb51c8f80ce6b453c7d8c4399af579d5175

  • SHA256

    ce6cf51607a2fd0b3aa61c066d0adf7d659418c4cd78ef8824a46f89e639867b

  • SHA512

    ccae4b5d7bb389872bc162e6c2d00f280b2537db53c2dd1fe7f55142552dc792bba1bfbef21182ba4355e3f2b473447d70e654403b385b55c7496111ac4178b7

  • SSDEEP

    12288:hTo2iNStcYl0SNGZSUKnBnn0kk9HSkqHcSxk9qNk2Q4PaUOvYbnjcueIGujE11/h:hTo1McNoGZS5CbHS9Hcz9qN3QIOQbnjO

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe
    "C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3268
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:3756
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IyoNJg.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2992
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IyoNJg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA8E2.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4092
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
        PID:1384
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        2⤵
          PID:4916
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          2⤵
            PID:1356

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          3d086a433708053f9bf9523e1d87a4e8

          SHA1

          b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

          SHA256

          6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

          SHA512

          931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          18KB

          MD5

          2a98d1816459e3b46bd459d286729cba

          SHA1

          f48f12d25ff80189c33cf735ab51c33f7015c880

          SHA256

          bfcbfdf4aca49b5d132714c2e2a390dfffaa4c5794168c97d11a1a2fd32267e9

          SHA512

          1cd059337a9dd2d4ae03578d51975e16fea5a0b43fe2e92a94c77402f969fe1958aa27c5bd9445018c6f7a2dde6f3d7ee1e9ccd0fad56b3be3abc39806526341

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fmwg50wz.3qa.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmpA8E2.tmp

          Filesize

          1KB

          MD5

          ba4b2a76b8986e2df5f763a5f2ace7f3

          SHA1

          d1f4bb0e7f00c7326609301c8646f053ec43cd81

          SHA256

          e7f9b54a0c5393e6ce0cd627a07b01f73edd7d2523e766364f284a18297460ba

          SHA512

          7443d5066336875390d965a0bf47bc840d8788d5b41867b4dff62619b8f8927de0afedad90ecce8234144ddc7da93825f7b44afa346994391e5e6f44c57d8a0c

        • memory/1356-93-0x0000000006830000-0x0000000006880000-memory.dmp

          Filesize

          320KB

        • memory/1356-48-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/2992-66-0x0000000075450000-0x000000007549C000-memory.dmp

          Filesize

          304KB

        • memory/2992-47-0x0000000074BE0000-0x0000000075390000-memory.dmp

          Filesize

          7.7MB

        • memory/2992-46-0x0000000074BE0000-0x0000000075390000-memory.dmp

          Filesize

          7.7MB

        • memory/2992-43-0x0000000005690000-0x00000000059E4000-memory.dmp

          Filesize

          3.3MB

        • memory/2992-92-0x0000000074BE0000-0x0000000075390000-memory.dmp

          Filesize

          7.7MB

        • memory/2992-80-0x00000000071B0000-0x00000000071C1000-memory.dmp

          Filesize

          68KB

        • memory/2992-44-0x0000000074BE0000-0x0000000075390000-memory.dmp

          Filesize

          7.7MB

        • memory/3268-6-0x0000000004F00000-0x0000000004F16000-memory.dmp

          Filesize

          88KB

        • memory/3268-50-0x0000000074BE0000-0x0000000075390000-memory.dmp

          Filesize

          7.7MB

        • memory/3268-16-0x0000000074BEE000-0x0000000074BEF000-memory.dmp

          Filesize

          4KB

        • memory/3268-10-0x0000000008A50000-0x0000000008AEC000-memory.dmp

          Filesize

          624KB

        • memory/3268-9-0x0000000006400000-0x0000000006484000-memory.dmp

          Filesize

          528KB

        • memory/3268-7-0x00000000051C0000-0x00000000051CE000-memory.dmp

          Filesize

          56KB

        • memory/3268-8-0x00000000051D0000-0x00000000051E0000-memory.dmp

          Filesize

          64KB

        • memory/3268-0-0x0000000074BEE000-0x0000000074BEF000-memory.dmp

          Filesize

          4KB

        • memory/3268-4-0x0000000074BE0000-0x0000000075390000-memory.dmp

          Filesize

          7.7MB

        • memory/3268-5-0x0000000004CA0000-0x0000000004CAA000-memory.dmp

          Filesize

          40KB

        • memory/3268-3-0x0000000004D30000-0x0000000004DC2000-memory.dmp

          Filesize

          584KB

        • memory/3268-45-0x0000000074BE0000-0x0000000075390000-memory.dmp

          Filesize

          7.7MB

        • memory/3268-2-0x0000000005240000-0x00000000057E4000-memory.dmp

          Filesize

          5.6MB

        • memory/3268-1-0x0000000000230000-0x00000000002E0000-memory.dmp

          Filesize

          704KB

        • memory/3756-18-0x0000000074BE0000-0x0000000075390000-memory.dmp

          Filesize

          7.7MB

        • memory/3756-21-0x00000000058A0000-0x0000000005906000-memory.dmp

          Filesize

          408KB

        • memory/3756-20-0x0000000005800000-0x0000000005822000-memory.dmp

          Filesize

          136KB

        • memory/3756-15-0x0000000002EA0000-0x0000000002ED6000-memory.dmp

          Filesize

          216KB

        • memory/3756-65-0x00000000079E0000-0x0000000007A83000-memory.dmp

          Filesize

          652KB

        • memory/3756-23-0x0000000074BE0000-0x0000000075390000-memory.dmp

          Filesize

          7.7MB

        • memory/3756-64-0x0000000006DA0000-0x0000000006DBE000-memory.dmp

          Filesize

          120KB

        • memory/3756-77-0x0000000007AE0000-0x0000000007AFA000-memory.dmp

          Filesize

          104KB

        • memory/3756-78-0x0000000007B50000-0x0000000007B5A000-memory.dmp

          Filesize

          40KB

        • memory/3756-76-0x0000000008130000-0x00000000087AA000-memory.dmp

          Filesize

          6.5MB

        • memory/3756-54-0x0000000075450000-0x000000007549C000-memory.dmp

          Filesize

          304KB

        • memory/3756-53-0x00000000077A0000-0x00000000077D2000-memory.dmp

          Filesize

          200KB

        • memory/3756-79-0x0000000007D60000-0x0000000007DF6000-memory.dmp

          Filesize

          600KB

        • memory/3756-52-0x0000000006D50000-0x0000000006D9C000-memory.dmp

          Filesize

          304KB

        • memory/3756-81-0x0000000007D10000-0x0000000007D1E000-memory.dmp

          Filesize

          56KB

        • memory/3756-83-0x0000000007D20000-0x0000000007D34000-memory.dmp

          Filesize

          80KB

        • memory/3756-84-0x0000000007E20000-0x0000000007E3A000-memory.dmp

          Filesize

          104KB

        • memory/3756-85-0x0000000007E00000-0x0000000007E08000-memory.dmp

          Filesize

          32KB

        • memory/3756-51-0x00000000067A0000-0x00000000067BE000-memory.dmp

          Filesize

          120KB

        • memory/3756-91-0x0000000074BE0000-0x0000000075390000-memory.dmp

          Filesize

          7.7MB

        • memory/3756-22-0x0000000006620000-0x0000000006686000-memory.dmp

          Filesize

          408KB

        • memory/3756-17-0x0000000005950000-0x0000000005F78000-memory.dmp

          Filesize

          6.2MB

        • memory/3756-19-0x0000000074BE0000-0x0000000075390000-memory.dmp

          Filesize

          7.7MB