Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
19/06/2024, 01:19
General
- Target SecuriteInfo.com.Win32.PWSX-gen.12840.10064.exe
- Size 814KB
- Sample240619-bphqmsvgnp
- SHA256 18f7507efdb35483a8642553f66647b9c1cc54d67614782622b7a64261042924
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.mahesh-ent.com
-
Port
587
-
Username
-
Password
M@hesh3981
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.12840.10064.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.12840.10064.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hebYuJoo.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hebYuJoo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp978D.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_0s0fhnp1.fnu.ps1
tmp978D.tmp
memory/712-67-0x0000000075090000-0x0000000075840000-memory.dmp
memory/712-66-0x0000000006480000-0x00000000064D0000-memory.dmp
memory/712-38-0x0000000075090000-0x0000000075840000-memory.dmp
memory/712-20-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3288-37-0x0000000075090000-0x0000000075840000-memory.dmp
memory/3288-4-0x00000000056F0000-0x00000000056FA000-memory.dmp
memory/3288-8-0x0000000005B70000-0x0000000005B82000-memory.dmp
memory/3288-9-0x0000000005B90000-0x0000000005B98000-memory.dmp
memory/3288-10-0x0000000006360000-0x000000000636C000-memory.dmp
memory/3288-11-0x00000000063B0000-0x0000000006434000-memory.dmp
memory/3288-1-0x0000000000C60000-0x0000000000D32000-memory.dmp
memory/3288-6-0x00000000067D0000-0x0000000006CFC000-memory.dmp
memory/3288-2-0x0000000005CF0000-0x0000000006294000-memory.dmp
memory/3288-7-0x00000000059D0000-0x0000000005A6C000-memory.dmp
memory/3288-5-0x0000000075090000-0x0000000075840000-memory.dmp
memory/3288-3-0x0000000005740000-0x00000000057D2000-memory.dmp
memory/3288-0-0x000000007509E000-0x000000007509F000-memory.dmp
memory/4036-21-0x0000000004EF0000-0x0000000004F12000-memory.dmp
memory/4036-54-0x0000000007800000-0x0000000007E7A000-memory.dmp
memory/4036-22-0x00000000055F0000-0x0000000005656000-memory.dmp
memory/4036-24-0x0000000075090000-0x0000000075840000-memory.dmp
memory/4036-23-0x0000000005710000-0x0000000005776000-memory.dmp
memory/4036-27-0x00000000058C0000-0x0000000005C14000-memory.dmp
memory/4036-17-0x0000000004F50000-0x0000000005578000-memory.dmp
memory/4036-39-0x0000000005E90000-0x0000000005EAE000-memory.dmp
memory/4036-40-0x0000000005F30000-0x0000000005F7C000-memory.dmp
memory/4036-41-0x0000000007060000-0x0000000007092000-memory.dmp
memory/4036-42-0x0000000075900000-0x000000007594C000-memory.dmp
memory/4036-52-0x0000000006440000-0x000000000645E000-memory.dmp
memory/4036-53-0x00000000070A0000-0x0000000007143000-memory.dmp
memory/4036-26-0x0000000075090000-0x0000000075840000-memory.dmp
memory/4036-55-0x00000000071B0000-0x00000000071CA000-memory.dmp
memory/4036-56-0x0000000007220000-0x000000000722A000-memory.dmp
memory/4036-57-0x0000000007430000-0x00000000074C6000-memory.dmp
memory/4036-58-0x00000000073B0000-0x00000000073C1000-memory.dmp
memory/4036-59-0x00000000073E0000-0x00000000073EE000-memory.dmp
memory/4036-60-0x00000000073F0000-0x0000000007404000-memory.dmp
memory/4036-61-0x00000000074F0000-0x000000000750A000-memory.dmp
memory/4036-62-0x00000000074D0000-0x00000000074D8000-memory.dmp
memory/4036-65-0x0000000075090000-0x0000000075840000-memory.dmp
memory/4036-19-0x0000000075090000-0x0000000075840000-memory.dmp
memory/4036-16-0x00000000048E0000-0x0000000004916000-memory.dmp