Analysis
- max time kernel
141s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
19/06/2024, 15:43
General
- Target PRODUCTS LIST.pdf.exe
- Size 620KB
- Sample240619-s6cpdssgrg
- SHA256 e6467422567d07f55c891b1c452dfb2c3c3d24ffa243799c91004cedb8a0dd0c
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.trisquarespl.com
-
Port
587
-
Username
-
Password
^uw)^EY5
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST.pdf.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST.pdf.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST.pdf.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_4psdi2za.beq.ps1
memory/1128-12-0x0000000000400000-0x0000000000440000-memory.dmp
memory/1128-59-0x0000000006400000-0x0000000006450000-memory.dmp
memory/1128-63-0x0000000074930000-0x00000000750E0000-memory.dmp
memory/1128-19-0x0000000074930000-0x00000000750E0000-memory.dmp
memory/1128-20-0x0000000004FB0000-0x0000000005016000-memory.dmp
memory/1128-15-0x0000000074930000-0x00000000750E0000-memory.dmp
memory/1512-5-0x00000000054C0000-0x00000000054CA000-memory.dmp
memory/1512-8-0x0000000005900000-0x0000000005912000-memory.dmp
memory/1512-9-0x0000000006550000-0x0000000006558000-memory.dmp
memory/1512-10-0x0000000006560000-0x000000000656C000-memory.dmp
memory/1512-11-0x0000000006F00000-0x0000000006F82000-memory.dmp
memory/1512-7-0x0000000005850000-0x00000000058EC000-memory.dmp
memory/1512-14-0x0000000074930000-0x00000000750E0000-memory.dmp
memory/1512-6-0x00000000065A0000-0x0000000006ACC000-memory.dmp
memory/1512-0-0x000000007493E000-0x000000007493F000-memory.dmp
memory/1512-4-0x0000000074930000-0x00000000750E0000-memory.dmp
memory/1512-3-0x00000000055B0000-0x0000000005642000-memory.dmp
memory/1512-2-0x0000000005AC0000-0x0000000006064000-memory.dmp
memory/1512-1-0x0000000000A60000-0x0000000000B02000-memory.dmp
memory/3592-24-0x0000000005A40000-0x0000000005AA6000-memory.dmp
memory/3592-49-0x0000000007340000-0x00000000073E3000-memory.dmp
memory/3592-22-0x0000000074930000-0x00000000750E0000-memory.dmp
memory/3592-23-0x0000000005920000-0x0000000005942000-memory.dmp
memory/3592-25-0x0000000005B20000-0x0000000005E74000-memory.dmp
memory/3592-17-0x0000000074930000-0x00000000750E0000-memory.dmp
memory/3592-35-0x0000000006120000-0x000000000613E000-memory.dmp
memory/3592-36-0x00000000061B0000-0x00000000061FC000-memory.dmp
memory/3592-37-0x0000000007300000-0x0000000007332000-memory.dmp
memory/3592-38-0x0000000070590000-0x00000000705DC000-memory.dmp
memory/3592-48-0x00000000066E0000-0x00000000066FE000-memory.dmp
memory/3592-16-0x0000000002810000-0x0000000002846000-memory.dmp
memory/3592-50-0x0000000007A90000-0x000000000810A000-memory.dmp
memory/3592-51-0x0000000007440000-0x000000000745A000-memory.dmp
memory/3592-52-0x00000000074B0000-0x00000000074BA000-memory.dmp
memory/3592-53-0x00000000076C0000-0x0000000007756000-memory.dmp
memory/3592-54-0x0000000007640000-0x0000000007651000-memory.dmp
memory/3592-55-0x0000000007670000-0x000000000767E000-memory.dmp
memory/3592-56-0x0000000007680000-0x0000000007694000-memory.dmp
memory/3592-57-0x0000000007780000-0x000000000779A000-memory.dmp
memory/3592-58-0x0000000007760000-0x0000000007768000-memory.dmp
memory/3592-18-0x00000000052F0000-0x0000000005918000-memory.dmp
memory/3592-62-0x0000000074930000-0x00000000750E0000-memory.dmp
memory/3592-21-0x0000000074930000-0x00000000750E0000-memory.dmp