Analysis
- max time kernel
39s - max time network
47s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
19/06/2024, 01:59
General
- Target 77d7a64d995e7c5e0aa0e91dcedd6c77bd86c008d2f87684201042c06eda345e.exe
- Size 679KB
- Sample240619-ceefxasamc
- SHA256 77d7a64d995e7c5e0aa0e91dcedd6c77bd86c008d2f87684201042c06eda345e
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.voivocars.com
-
Port
587
-
Username
-
Password
Gempaid
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\77d7a64d995e7c5e0aa0e91dcedd6c77bd86c008d2f87684201042c06eda345e.exe"C:\Users\Admin\AppData\Local\Temp\77d7a64d995e7c5e0aa0e91dcedd6c77bd86c008d2f87684201042c06eda345e.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\77d7a64d995e7c5e0aa0e91dcedd6c77bd86c008d2f87684201042c06eda345e.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IzzQIY.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IzzQIY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8608.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_g3w2nppq.4ze.ps1
tmp8608.tmp
memory/2828-4-0x00000000053B0000-0x00000000053BA000-memory.dmp
memory/2828-5-0x00000000056E0000-0x000000000577C000-memory.dmp
memory/2828-6-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/2828-7-0x0000000005780000-0x0000000005798000-memory.dmp
memory/2828-8-0x00000000066A0000-0x00000000066B0000-memory.dmp
memory/2828-9-0x0000000007EC0000-0x0000000007F42000-memory.dmp
memory/2828-0-0x00000000747AE000-0x00000000747AF000-memory.dmp
memory/2828-3-0x0000000005400000-0x0000000005492000-memory.dmp
memory/2828-2-0x0000000005AF0000-0x0000000006094000-memory.dmp
memory/2828-46-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/2828-1-0x0000000000910000-0x00000000009C0000-memory.dmp
memory/2844-88-0x0000000006BB0000-0x0000000006C00000-memory.dmp
memory/2844-44-0x0000000000400000-0x0000000000440000-memory.dmp
memory/5016-15-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/5016-79-0x00000000079E0000-0x00000000079FA000-memory.dmp
memory/5016-14-0x0000000002A60000-0x0000000002A96000-memory.dmp
memory/5016-24-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/5016-86-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/5016-16-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/5016-80-0x00000000079C0000-0x00000000079C8000-memory.dmp
memory/5016-76-0x00000000078A0000-0x00000000078B1000-memory.dmp
memory/5016-47-0x0000000006260000-0x000000000627E000-memory.dmp
memory/5016-48-0x00000000063F0000-0x000000000643C000-memory.dmp
memory/5016-49-0x0000000007330000-0x0000000007362000-memory.dmp
memory/5016-69-0x0000000006930000-0x000000000694E000-memory.dmp
memory/5016-70-0x0000000007570000-0x0000000007613000-memory.dmp
memory/5016-50-0x0000000070F90000-0x0000000070FDC000-memory.dmp
memory/5112-77-0x0000000007810000-0x000000000781E000-memory.dmp
memory/5112-23-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/5112-73-0x00000000075E0000-0x00000000075FA000-memory.dmp
memory/5112-74-0x0000000007650000-0x000000000765A000-memory.dmp
memory/5112-75-0x0000000007860000-0x00000000078F6000-memory.dmp
memory/5112-18-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/5112-72-0x0000000007C20000-0x000000000829A000-memory.dmp
memory/5112-21-0x0000000005A20000-0x0000000005A86000-memory.dmp
memory/5112-60-0x0000000070F90000-0x0000000070FDC000-memory.dmp
memory/5112-22-0x0000000005A90000-0x0000000005AF6000-memory.dmp
memory/5112-78-0x0000000007820000-0x0000000007834000-memory.dmp
memory/5112-17-0x00000000053F0000-0x0000000005A18000-memory.dmp
memory/5112-35-0x0000000005C40000-0x0000000005F94000-memory.dmp
memory/5112-87-0x00000000747A0000-0x0000000074F50000-memory.dmp
memory/5112-20-0x00000000052F0000-0x0000000005312000-memory.dmp