Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    12-06-2024 02:03

General

  • Target

    4b13fee13544dc3148752435f83f9861e3d14a117ad645d015e336da00ffceff.exe

  • Size

    689KB

  • MD5

    217fd03c398f156a343e2791206505ad

  • SHA1

    cc819116f40772ec1ffba29c452063c04d552eaf

  • SHA256

    4b13fee13544dc3148752435f83f9861e3d14a117ad645d015e336da00ffceff

  • SHA512

    fcb633fa506a5212e37fb138b216585af1ad7b25c18685a97ca1b7b9ed4794da7291053da5eefac2a1dac17242feb3f20e6d976db7f7cd7f7794522a4a800af1

  • SSDEEP

    12288:H4rx504bFC8VPhPXJfgEbUUz7oBIxtNwwWyPtPew42OZca7L+xN:Yrw4bPPPfg2UYNwwW+PqDZcALg

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b13fee13544dc3148752435f83f9861e3d14a117ad645d015e336da00ffceff.exe
    "C:\Users\Admin\AppData\Local\Temp\4b13fee13544dc3148752435f83f9861e3d14a117ad645d015e336da00ffceff.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2944
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4b13fee13544dc3148752435f83f9861e3d14a117ad645d015e336da00ffceff.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2260
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cGhOYFUbb.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2624
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cGhOYFUbb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp39C6.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2644
    • C:\Users\Admin\AppData\Local\Temp\4b13fee13544dc3148752435f83f9861e3d14a117ad645d015e336da00ffceff.exe
      "C:\Users\Admin\AppData\Local\Temp\4b13fee13544dc3148752435f83f9861e3d14a117ad645d015e336da00ffceff.exe"
      2⤵
        PID:3032
      • C:\Users\Admin\AppData\Local\Temp\4b13fee13544dc3148752435f83f9861e3d14a117ad645d015e336da00ffceff.exe
        "C:\Users\Admin\AppData\Local\Temp\4b13fee13544dc3148752435f83f9861e3d14a117ad645d015e336da00ffceff.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2576

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp39C6.tmp

      Filesize

      1KB

      MD5

      67f824dcdefaeb745f90add5df954183

      SHA1

      9182c3c1eac57dc538f21cafb2a3cf385e65d4d0

      SHA256

      e486c65cb538a2306897dacb5b1d79fe2338a8b43bbbad408293a9e607bee0d1

      SHA512

      88c6b9e6d98882b7448d93e117bd0b8b79e369b75bffc3f555b459dcc2c1f4fbd175c769a2ebf43335747f9b9ec35778a97f41b8d140a52bdb85fec662b3009c

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XWDQCIFQO63381QROFYL.temp

      Filesize

      7KB

      MD5

      0f64b5cb51a581c3e9f3058c170294b6

      SHA1

      0bef292fa15a88aa1082ecdee619e9fc34e53bff

      SHA256

      a46b5ccf3a2c3d61e91f9e248f890b0baf17864445710ff8e0347c68eb3eba30

      SHA512

      39ef635e76d41d1b040bf2eafdbf78934a4bd3c89d1dc944651f563b4807440c3527ccd77956f453b359f6d365ec4f92eb0c88422abebfb15090a251906c4f1e

    • memory/2576-26-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2576-17-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2576-19-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2576-27-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2576-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2576-23-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2576-29-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2576-21-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2944-3-0x0000000000420000-0x0000000000430000-memory.dmp

      Filesize

      64KB

    • memory/2944-4-0x0000000004940000-0x00000000049C4000-memory.dmp

      Filesize

      528KB

    • memory/2944-2-0x0000000000960000-0x000000000097A000-memory.dmp

      Filesize

      104KB

    • memory/2944-1-0x0000000000F50000-0x0000000001002000-memory.dmp

      Filesize

      712KB

    • memory/2944-0-0x00000000778A0000-0x0000000077A49000-memory.dmp

      Filesize

      1.7MB