Analysis

  • max time kernel
    52s
  • max time network
    54s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-06-2024 13:06

General

  • Target

    Payment Receipt-BOA.scr.exe

  • Size

    825KB

  • MD5

    d4dbbdfc8414d2f370f31e3b89aaa464

  • SHA1

    3ef59b12ddb45ec3c648f48535bd0d8688355432

  • SHA256

    7ef843eff8a539d4296d4ef84613b9d1efae655d3d5bbe7d23972ac414e0a25b

  • SHA512

    3a514a0bc9f360167ccefe921542d2625fc7bac1ce3e999b9d84131de9bb39b00b37594dc707d7f57bfba97fd6bb16be86acbe870961677017d548e69890c408

  • SSDEEP

    12288:NvlWc81Hsca5ZECpas1Ld9MRJsAOQpIwWwFdWWef3gOoN9PvXptZdkR:ZlS3vs1cN3W20WefgOqXX9A

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Payment Receipt-BOA.scr.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment Receipt-BOA.scr.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:216
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SVBDTv.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3928
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SVBDTv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9069.tmp"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3936
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
        PID:2340
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        2⤵
          PID:3612
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          2⤵
            PID:5104
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2052

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vii3qqbd.kbt.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmp9069.tmp

          Filesize

          1KB

          MD5

          990d7330d62b02f29e105160bfb3a1b3

          SHA1

          c9f5cdb1fc558b41bf51d548bd7d78d687627121

          SHA256

          acf0fb1f19c4dd8718d774714fa4f9f67b9cf5ab29d29ad2fde81bb79c91d090

          SHA512

          1a76907c5fc858b2b7716daf805907a61a3f20eadd2a0588acf9c253d304a0424530b348362eab6675cd307621860774707322e528c40b36547fab8c7f00847d

        • memory/216-6-0x0000000006870000-0x0000000006D9C000-memory.dmp

          Filesize

          5.2MB

        • memory/216-3-0x0000000005660000-0x00000000056F2000-memory.dmp

          Filesize

          584KB

        • memory/216-4-0x00000000031F0000-0x00000000031FA000-memory.dmp

          Filesize

          40KB

        • memory/216-5-0x0000000074C80000-0x0000000075430000-memory.dmp

          Filesize

          7.7MB

        • memory/216-2-0x0000000005D90000-0x0000000006334000-memory.dmp

          Filesize

          5.6MB

        • memory/216-7-0x0000000005970000-0x0000000005A0C000-memory.dmp

          Filesize

          624KB

        • memory/216-8-0x0000000005950000-0x0000000005962000-memory.dmp

          Filesize

          72KB

        • memory/216-9-0x0000000005B50000-0x0000000005B58000-memory.dmp

          Filesize

          32KB

        • memory/216-10-0x0000000005B70000-0x0000000005B7C000-memory.dmp

          Filesize

          48KB

        • memory/216-11-0x00000000063C0000-0x0000000006444000-memory.dmp

          Filesize

          528KB

        • memory/216-37-0x0000000074C80000-0x0000000075430000-memory.dmp

          Filesize

          7.7MB

        • memory/216-0-0x0000000074C8E000-0x0000000074C8F000-memory.dmp

          Filesize

          4KB

        • memory/216-1-0x0000000000BA0000-0x0000000000C72000-memory.dmp

          Filesize

          840KB

        • memory/2052-30-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/2052-65-0x0000000006730000-0x0000000006780000-memory.dmp

          Filesize

          320KB

        • memory/3928-41-0x0000000071320000-0x000000007136C000-memory.dmp

          Filesize

          304KB

        • memory/3928-35-0x0000000005870000-0x0000000005BC4000-memory.dmp

          Filesize

          3.3MB

        • memory/3928-51-0x0000000006430000-0x000000000644E000-memory.dmp

          Filesize

          120KB

        • memory/3928-17-0x0000000074C80000-0x0000000075430000-memory.dmp

          Filesize

          7.7MB

        • memory/3928-52-0x0000000007020000-0x00000000070C3000-memory.dmp

          Filesize

          652KB

        • memory/3928-16-0x0000000002550000-0x0000000002586000-memory.dmp

          Filesize

          216KB

        • memory/3928-22-0x0000000005720000-0x0000000005786000-memory.dmp

          Filesize

          408KB

        • memory/3928-53-0x00000000077A0000-0x0000000007E1A000-memory.dmp

          Filesize

          6.5MB

        • memory/3928-38-0x0000000005E00000-0x0000000005E1E000-memory.dmp

          Filesize

          120KB

        • memory/3928-39-0x0000000005E60000-0x0000000005EAC000-memory.dmp

          Filesize

          304KB

        • memory/3928-40-0x00000000063F0000-0x0000000006422000-memory.dmp

          Filesize

          200KB

        • memory/3928-20-0x0000000074C80000-0x0000000075430000-memory.dmp

          Filesize

          7.7MB

        • memory/3928-19-0x0000000005080000-0x00000000056A8000-memory.dmp

          Filesize

          6.2MB

        • memory/3928-24-0x0000000074C80000-0x0000000075430000-memory.dmp

          Filesize

          7.7MB

        • memory/3928-21-0x0000000004F70000-0x0000000004F92000-memory.dmp

          Filesize

          136KB

        • memory/3928-54-0x0000000007160000-0x000000000717A000-memory.dmp

          Filesize

          104KB

        • memory/3928-55-0x00000000071D0000-0x00000000071DA000-memory.dmp

          Filesize

          40KB

        • memory/3928-56-0x00000000073E0000-0x0000000007476000-memory.dmp

          Filesize

          600KB

        • memory/3928-57-0x0000000007360000-0x0000000007371000-memory.dmp

          Filesize

          68KB

        • memory/3928-58-0x0000000007390000-0x000000000739E000-memory.dmp

          Filesize

          56KB

        • memory/3928-59-0x00000000073A0000-0x00000000073B4000-memory.dmp

          Filesize

          80KB

        • memory/3928-60-0x00000000074A0000-0x00000000074BA000-memory.dmp

          Filesize

          104KB

        • memory/3928-61-0x0000000007480000-0x0000000007488000-memory.dmp

          Filesize

          32KB

        • memory/3928-64-0x0000000074C80000-0x0000000075430000-memory.dmp

          Filesize

          7.7MB

        • memory/3928-23-0x0000000005800000-0x0000000005866000-memory.dmp

          Filesize

          408KB