Analysis

  • max time kernel
    148s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    18-06-2024 16:15

General

  • Target

    SploitXE Release/SploitXE.exe

  • Size

    59KB

  • MD5

    8f53627c43fe6a510a9fc17a7a50c348

  • SHA1

    813323918300c83c8878a043db0631b1d156f07a

  • SHA256

    f8fd35f40cf45e0332813d5ac555663c6d041256120d6e0fd0300d7b677379e1

  • SHA512

    f4e0f4e3cf8833b9caab846e16558b882905d2cf5d0f037aa15cbe818f33052236780aea4c5e84eafc61333e63decfe64c694f1536117d39001a2e39f8f58c11

  • SSDEEP

    768:QUNFDR8oN3NmUqVLVbXrhsPWHrdRpfO4HjCMLpPd0:lR8oN3c3O0rdRpfO4DpLdd0

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 3 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 8 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SploitXE Release\SploitXE.exe
    "C:\Users\Admin\AppData\Local\Temp\SploitXE Release\SploitXE.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Users\Admin\AppData\Local\Temp\SploitXE Release\rbxfpsunlocker.exe
      "C:\Users\Admin\AppData\Local\Temp\SploitXE Release\rbxfpsunlocker.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2600
    • C:\Users\Admin\AppData\Local\Temp\SploitXE Release\setup.exe
      "C:\Users\Admin\AppData\Local\Temp\SploitXE Release\setup.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1584
      • C:\Fraps\fraps.exe
        "C:\Fraps\fraps.exe" /exit
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        PID:3048
  • C:\Fraps\fraps.exe
    "C:\Fraps\fraps.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2452
  • C:\Fraps\fraps.exe
    "C:\Fraps\fraps.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Modifies registry class
    PID:3028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Fraps\FRAPSLCD.DLL

    Filesize

    170KB

    MD5

    895c32a4eefd648d62e92201e4954cd2

    SHA1

    5d7753f95ab95176da45473eaa0d7de29ca02973

    SHA256

    1376f53554c5977a627a7e749dd147cd10e7735ef4b860fd69b7ae31a7b15e74

    SHA512

    76823f00376aff72b7ddf7fad259a43cdc5feec5486e3d79f6d63758f7325059d8e83dc10beb9447254501fe606b9f17fa6ed4d54f98a59dd4571453ff58fb35

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar5546.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Fraps\fraps.exe

    Filesize

    2.5MB

    MD5

    0ff5b5161a78bf5721811779376db71d

    SHA1

    35308429117b514237d34bd8015bfe4efa8e7d55

    SHA256

    da7f61f2b04266a2ae897a0b001e721f1920cb579d5e08a8e5930a79c5d2fb80

    SHA512

    d701440fa49f287a9631c8fb98cef5ea89b4f135901519d3ff3c45d0a7b8c464901514078bcf5ea8d2ffd23dbc7e30816ec0beaf06a531af045fdd1f5aec0204

  • \Fraps\fraps32.dll

    Filesize

    263KB

    MD5

    6328007efe11f2ad0a50f122367ce743

    SHA1

    3f48580a32d0c5cd2551dcbcbce885c9337ce044

    SHA256

    e800f37cb2efa8ba13a25278cdd578dae4a2c86d23d4247349673160b0301e4f

    SHA512

    67d38b4dadecf020d1dc1e567327b5c0ebb72391448956e3e5a99943b6552851a94236d407da47c70abeed841898d2681382d78c522a40f28f22bbb654f7a8ec

  • \Users\Admin\AppData\Local\Temp\nsy68F2.tmp\AdvSplash.dll

    Filesize

    6KB

    MD5

    13cc92f90a299f5b2b2f795d0d2e47dc

    SHA1

    aa69ead8520876d232c6ed96021a4825e79f542f

    SHA256

    eb1ca2b3a6e564c32677d0cdc388e26b74ef686e071d7dbca44d0bfa10488feb

    SHA512

    ff4e6e6e7104568fc85ef3a3f0494a5c7822a4ceaf65c584ad534f08f9a472a8d86f0a62f1f86343c61e2540b2254714b7ea43e4b312ff13d8271ff069386fa3

  • \Users\Admin\AppData\Local\Temp\nsy68F2.tmp\StartMenu.dll

    Filesize

    7KB

    MD5

    a4173b381625f9f12aadb4e1cdaefdb8

    SHA1

    cf1680c2bc970d5675adbf5e89292a97e6724713

    SHA256

    7755ff2707ca19344d489a5acec02d9e310425fa6e100d2f13025761676b875b

    SHA512

    fcac79d42862da6bdd3ecad9d887a975cdff2301a8322f321be58f754a26b27077b452faa4751bbd09cd3371b4afce65255fbbb443e2c93dd2cba0ba652f4a82

  • \Users\Admin\AppData\Local\Temp\nsy68F2.tmp\System.dll

    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

  • memory/1584-104-0x0000000001FC0000-0x0000000001FD0000-memory.dmp

    Filesize

    64KB

  • memory/1584-114-0x0000000003EC0000-0x00000000046C3000-memory.dmp

    Filesize

    8.0MB

  • memory/2264-2-0x0000000004C40000-0x0000000004E54000-memory.dmp

    Filesize

    2.1MB

  • memory/2264-5-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

    Filesize

    4KB

  • memory/2264-4-0x0000000073FD0000-0x00000000746BE000-memory.dmp

    Filesize

    6.9MB

  • memory/2264-66-0x0000000073FD0000-0x00000000746BE000-memory.dmp

    Filesize

    6.9MB

  • memory/2264-0-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

    Filesize

    4KB

  • memory/2264-3-0x0000000073FD0000-0x00000000746BE000-memory.dmp

    Filesize

    6.9MB

  • memory/2264-6-0x0000000073FD0000-0x00000000746BE000-memory.dmp

    Filesize

    6.9MB

  • memory/2264-1-0x00000000008B0000-0x00000000008C6000-memory.dmp

    Filesize

    88KB

  • memory/2452-145-0x0000000000400000-0x0000000000C03000-memory.dmp

    Filesize

    8.0MB

  • memory/2452-148-0x0000000004D00000-0x0000000004D0A000-memory.dmp

    Filesize

    40KB

  • memory/2452-154-0x0000000000400000-0x0000000000C03000-memory.dmp

    Filesize

    8.0MB

  • memory/2452-131-0x0000000000400000-0x0000000000C03000-memory.dmp

    Filesize

    8.0MB

  • memory/2452-153-0x0000000000400000-0x0000000000C03000-memory.dmp

    Filesize

    8.0MB

  • memory/2452-140-0x0000000004D00000-0x0000000004D0A000-memory.dmp

    Filesize

    40KB

  • memory/2452-141-0x0000000004D00000-0x0000000004D0A000-memory.dmp

    Filesize

    40KB

  • memory/2452-139-0x0000000004D00000-0x0000000004D0A000-memory.dmp

    Filesize

    40KB

  • memory/2452-138-0x0000000004D00000-0x0000000004D0A000-memory.dmp

    Filesize

    40KB

  • memory/2452-137-0x0000000004D00000-0x0000000004D0A000-memory.dmp

    Filesize

    40KB

  • memory/2452-136-0x0000000004D00000-0x0000000004D0A000-memory.dmp

    Filesize

    40KB

  • memory/2452-135-0x0000000000400000-0x0000000000C03000-memory.dmp

    Filesize

    8.0MB

  • memory/2452-134-0x0000000000400000-0x0000000000C03000-memory.dmp

    Filesize

    8.0MB

  • memory/2452-152-0x0000000000400000-0x0000000000C03000-memory.dmp

    Filesize

    8.0MB

  • memory/2452-144-0x0000000000400000-0x0000000000C03000-memory.dmp

    Filesize

    8.0MB

  • memory/2452-151-0x0000000000400000-0x0000000000C03000-memory.dmp

    Filesize

    8.0MB

  • memory/2452-146-0x0000000004D00000-0x0000000004D0A000-memory.dmp

    Filesize

    40KB

  • memory/2452-150-0x0000000004D00000-0x0000000004D0A000-memory.dmp

    Filesize

    40KB

  • memory/2452-149-0x0000000004D00000-0x0000000004D0A000-memory.dmp

    Filesize

    40KB

  • memory/2452-126-0x0000000000400000-0x0000000000C03000-memory.dmp

    Filesize

    8.0MB

  • memory/2452-147-0x0000000004D00000-0x0000000004D0A000-memory.dmp

    Filesize

    40KB

  • memory/3028-143-0x0000000000400000-0x0000000000C03000-memory.dmp

    Filesize

    8.0MB

  • memory/3028-133-0x0000000000400000-0x0000000000C03000-memory.dmp

    Filesize

    8.0MB

  • memory/3048-115-0x0000000000400000-0x0000000000C03000-memory.dmp

    Filesize

    8.0MB

  • memory/3048-117-0x0000000000400000-0x0000000000C03000-memory.dmp

    Filesize

    8.0MB