Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 02:03

General

  • Target

    RFQ - 026.exe

  • Size

    750KB

  • MD5

    28a4d4adbc0134107703cd1b2d800052

  • SHA1

    62c5a02ca9fc8ce570992f37a433ef5eb811eb98

  • SHA256

    a10341c58574b8a08c3f1469fadf00b14d93376e3cfe50d0799bac052462d170

  • SHA512

    0b672ba0cea136c277e65eee0b114dd9d4fdb4691d6194dec3c423e16bb3c687d0fd0890c99d8626b8d87a8eacaff9de0d2cfad316b89e43bdce2df84e5af548

  • SSDEEP

    12288:WHtZIA61Eix1//lmek//1ECz0mcMtOzGQRv2XMZACR5leZlN:WHEp1Eix9wbSeo6QRPZA+er

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RFQ - 026.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ - 026.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4060
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rCDSBGfJmL.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2464
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rCDSBGfJmL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1AA7.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4036
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
        PID:1104
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        2⤵
          PID:4864
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          2⤵
            PID:2160
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4732
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4068,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
          1⤵
            PID:4700

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yppsdcrm.xnf.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\tmp1AA7.tmp

            Filesize

            1KB

            MD5

            84735ba27ac7e777b94ac2886997c6b0

            SHA1

            7c8cd84d20736350d66a58e8140ca97911c844f3

            SHA256

            d9364e89f7b0cc4be78f1dc9a89af00f19b421ea4015cdf6bdd27a98eed203bf

            SHA512

            57e15145df4e93ddfc0e563c8d9e84a83a63ec561e8f0dad95e7191b321e63c21f67a031c4a5baadd6581d2297b273c1ee5423b713f132c1b730cfc11fc71323

          • memory/2464-28-0x0000000005A90000-0x0000000005DE4000-memory.dmp

            Filesize

            3.3MB

          • memory/2464-62-0x0000000075350000-0x0000000075B00000-memory.dmp

            Filesize

            7.7MB

          • memory/2464-22-0x0000000075350000-0x0000000075B00000-memory.dmp

            Filesize

            7.7MB

          • memory/2464-59-0x00000000076E0000-0x00000000076E8000-memory.dmp

            Filesize

            32KB

          • memory/2464-58-0x0000000007700000-0x000000000771A000-memory.dmp

            Filesize

            104KB

          • memory/2464-57-0x0000000007600000-0x0000000007614000-memory.dmp

            Filesize

            80KB

          • memory/2464-56-0x00000000075F0000-0x00000000075FE000-memory.dmp

            Filesize

            56KB

          • memory/2464-55-0x00000000075C0000-0x00000000075D1000-memory.dmp

            Filesize

            68KB

          • memory/2464-54-0x0000000007640000-0x00000000076D6000-memory.dmp

            Filesize

            600KB

          • memory/2464-15-0x0000000075350000-0x0000000075B00000-memory.dmp

            Filesize

            7.7MB

          • memory/2464-16-0x00000000052E0000-0x0000000005908000-memory.dmp

            Filesize

            6.2MB

          • memory/2464-53-0x0000000007430000-0x000000000743A000-memory.dmp

            Filesize

            40KB

          • memory/2464-21-0x0000000075350000-0x0000000075B00000-memory.dmp

            Filesize

            7.7MB

          • memory/2464-20-0x00000000051D0000-0x0000000005236000-memory.dmp

            Filesize

            408KB

          • memory/2464-19-0x0000000005160000-0x00000000051C6000-memory.dmp

            Filesize

            408KB

          • memory/2464-18-0x00000000050C0000-0x00000000050E2000-memory.dmp

            Filesize

            136KB

          • memory/2464-52-0x00000000073C0000-0x00000000073DA000-memory.dmp

            Filesize

            104KB

          • memory/2464-51-0x0000000007A20000-0x000000000809A000-memory.dmp

            Filesize

            6.5MB

          • memory/2464-14-0x00000000027A0000-0x00000000027D6000-memory.dmp

            Filesize

            216KB

          • memory/2464-50-0x00000000070F0000-0x0000000007193000-memory.dmp

            Filesize

            652KB

          • memory/2464-49-0x00000000066B0000-0x00000000066CE000-memory.dmp

            Filesize

            120KB

          • memory/2464-36-0x00000000065A0000-0x00000000065EC000-memory.dmp

            Filesize

            304KB

          • memory/2464-35-0x0000000006080000-0x000000000609E000-memory.dmp

            Filesize

            120KB

          • memory/2464-38-0x00000000070B0000-0x00000000070E2000-memory.dmp

            Filesize

            200KB

          • memory/2464-39-0x00000000702A0000-0x00000000702EC000-memory.dmp

            Filesize

            304KB

          • memory/4060-8-0x00000000061A0000-0x0000000006222000-memory.dmp

            Filesize

            520KB

          • memory/4060-3-0x0000000004D40000-0x0000000004DD2000-memory.dmp

            Filesize

            584KB

          • memory/4060-1-0x0000000000210000-0x00000000002D2000-memory.dmp

            Filesize

            776KB

          • memory/4060-2-0x0000000005250000-0x00000000057F4000-memory.dmp

            Filesize

            5.6MB

          • memory/4060-37-0x0000000075350000-0x0000000075B00000-memory.dmp

            Filesize

            7.7MB

          • memory/4060-0-0x000000007535E000-0x000000007535F000-memory.dmp

            Filesize

            4KB

          • memory/4060-6-0x00000000050E0000-0x0000000005102000-memory.dmp

            Filesize

            136KB

          • memory/4060-7-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

            Filesize

            64KB

          • memory/4060-9-0x0000000008DF0000-0x0000000008E8C000-memory.dmp

            Filesize

            624KB

          • memory/4060-5-0x0000000075350000-0x0000000075B00000-memory.dmp

            Filesize

            7.7MB

          • memory/4060-4-0x0000000004CE0000-0x0000000004CEA000-memory.dmp

            Filesize

            40KB

          • memory/4732-29-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

          • memory/4732-63-0x0000000006E60000-0x0000000006EB0000-memory.dmp

            Filesize

            320KB