Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
17/06/2024, 01:02
General
- Target 127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe
- Size 1.0MB
- Sample240617-bd5e9swhrf
- SHA256 127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.naveentour.com
-
Port
587
-
Username
-
Password
nav!T6u2@001
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe"C:\Users\Admin\AppData\Local\Temp\127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\127e68ca27a35db46bd09e61516bc247e517daea3f66bc23fb74132260958955.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SPrhntBmeSyq.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SPrhntBmeSyq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6486.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
__PSScriptPolicyTest_rcsvrdcb.1gf.ps1
tmp6486.tmp
memory/1864-6-0x0000000006780000-0x000000000679A000-memory.dmp
memory/1864-4-0x0000000004E10000-0x0000000004E1A000-memory.dmp
memory/1864-5-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/1864-3-0x0000000004C70000-0x0000000004D02000-memory.dmp
memory/1864-7-0x0000000005E30000-0x0000000005E40000-memory.dmp
memory/1864-8-0x0000000006850000-0x00000000068FA000-memory.dmp
memory/1864-9-0x0000000008F20000-0x0000000008FBC000-memory.dmp
memory/1864-2-0x0000000005220000-0x00000000057C4000-memory.dmp
memory/1864-0-0x00000000751AE000-0x00000000751AF000-memory.dmp
memory/1864-37-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/1864-1-0x0000000000160000-0x0000000000268000-memory.dmp
memory/2772-73-0x0000000007770000-0x0000000007DEA000-memory.dmp
memory/2772-52-0x0000000071990000-0x00000000719DC000-memory.dmp
memory/2772-88-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/2772-81-0x0000000007490000-0x00000000074AA000-memory.dmp
memory/2772-79-0x0000000007380000-0x000000000738E000-memory.dmp
memory/2772-23-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/2772-77-0x0000000007350000-0x0000000007361000-memory.dmp
memory/2772-76-0x00000000073D0000-0x0000000007466000-memory.dmp
memory/2772-19-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/2772-75-0x00000000071C0000-0x00000000071CA000-memory.dmp
memory/2772-38-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/2772-74-0x0000000007130000-0x000000000714A000-memory.dmp
memory/3740-17-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/3740-16-0x0000000004DC0000-0x00000000053E8000-memory.dmp
memory/3740-71-0x0000000006C90000-0x0000000006CAE000-memory.dmp
memory/3740-72-0x0000000006D00000-0x0000000006DA3000-memory.dmp
memory/3740-48-0x0000000005B10000-0x0000000005B2E000-memory.dmp
memory/3740-51-0x0000000071990000-0x00000000719DC000-memory.dmp
memory/3740-50-0x0000000006CB0000-0x0000000006CE2000-memory.dmp
memory/3740-15-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/3740-26-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/3740-49-0x0000000005BB0000-0x0000000005BFC000-memory.dmp
memory/3740-87-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/3740-25-0x0000000005540000-0x0000000005894000-memory.dmp
memory/3740-20-0x0000000004D70000-0x0000000004D92000-memory.dmp
memory/3740-80-0x0000000007090000-0x00000000070A4000-memory.dmp
memory/3740-21-0x0000000005460000-0x00000000054C6000-memory.dmp
memory/3740-82-0x0000000007170000-0x0000000007178000-memory.dmp
memory/3740-14-0x00000000045B0000-0x00000000045E6000-memory.dmp
memory/3740-22-0x00000000054D0000-0x0000000005536000-memory.dmp
memory/4384-24-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4384-89-0x0000000006130000-0x0000000006180000-memory.dmp