Analysis

  • max time kernel
    51s
  • max time network
    54s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-06-2024 15:15

General

  • Target

    1b68fe4f599f20aa70efb528ec45495683877193869eb95cd77119bcac096cd1.exe

  • Size

    661KB

  • MD5

    c90b8187b8db56562cb03af9d67e61d5

  • SHA1

    0f688b5d1f4d7b024ca0d9a306ffcb273b2fe1df

  • SHA256

    1b68fe4f599f20aa70efb528ec45495683877193869eb95cd77119bcac096cd1

  • SHA512

    ca943e78deead0c9a954a6eb20ded223e9408b3a457957e56b73c4432aaf06b072a269c8c1bc00d43a4aabe1578f0b18147f074f719239447313ca7db4b05bd1

  • SSDEEP

    12288:0FIsPADvFgvHqtIjdX6UsXvXkkywZCujmt28pip7txWjekR:WIKA2vHcIJFsXvXkkxZCIk286tG

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b68fe4f599f20aa70efb528ec45495683877193869eb95cd77119bcac096cd1.exe
    "C:\Users\Admin\AppData\Local\Temp\1b68fe4f599f20aa70efb528ec45495683877193869eb95cd77119bcac096cd1.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4712
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1b68fe4f599f20aa70efb528ec45495683877193869eb95cd77119bcac096cd1.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4748
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZgvUYcgWaiQFD.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4808
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZgvUYcgWaiQFD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp78CA.tmp"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3720
    • C:\Users\Admin\AppData\Local\Temp\1b68fe4f599f20aa70efb528ec45495683877193869eb95cd77119bcac096cd1.exe
      "C:\Users\Admin\AppData\Local\Temp\1b68fe4f599f20aa70efb528ec45495683877193869eb95cd77119bcac096cd1.exe"
      2⤵
        PID:4508
      • C:\Users\Admin\AppData\Local\Temp\1b68fe4f599f20aa70efb528ec45495683877193869eb95cd77119bcac096cd1.exe
        "C:\Users\Admin\AppData\Local\Temp\1b68fe4f599f20aa70efb528ec45495683877193869eb95cd77119bcac096cd1.exe"
        2⤵
          PID:3020
        • C:\Users\Admin\AppData\Local\Temp\1b68fe4f599f20aa70efb528ec45495683877193869eb95cd77119bcac096cd1.exe
          "C:\Users\Admin\AppData\Local\Temp\1b68fe4f599f20aa70efb528ec45495683877193869eb95cd77119bcac096cd1.exe"
          2⤵
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3248

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        3d086a433708053f9bf9523e1d87a4e8

        SHA1

        b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

        SHA256

        6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

        SHA512

        931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        18KB

        MD5

        6d079d093db369978c4496c60e40f516

        SHA1

        81ad1833cc32a622fce38dd5a03cbde80abae1b6

        SHA256

        e83415c9a8f80e6611ee6506c0f6e892c502ae0d790ce2c775b32288a8c00f47

        SHA512

        33a48841765ce9c1d8ba4debf3918dc87088821d93b0f53019c80fe5e05d1ca5ab1cbbdc71b72df2aca7e1d500143cf21d46941cbf5cbdf7b38cf9e5457d9178

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fkbmvzb4.qst.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\tmp78CA.tmp

        Filesize

        1KB

        MD5

        c988b1d9ed8a78cbbe9a679e68974613

        SHA1

        34f0770cca6255b7390b1156c9c5240a277fd394

        SHA256

        92a5c138f911063a9a6e7d0d3c953157294c41847f45c7a3f2d4cb26fc0af274

        SHA512

        4dc2d34e2258d26e905dff6c655d14201eab228401c495726bc8bca7e2c8d487e74feb10be0f7b6c5cf4ba4ee1592a185c316e0e6d02b33c29d53871d7d79c95

      • memory/3248-87-0x00000000068B0000-0x0000000006900000-memory.dmp

        Filesize

        320KB

      • memory/3248-43-0x0000000000400000-0x0000000000442000-memory.dmp

        Filesize

        264KB

      • memory/4712-4-0x0000000004DA0000-0x0000000004DAA000-memory.dmp

        Filesize

        40KB

      • memory/4712-7-0x0000000005010000-0x0000000005022000-memory.dmp

        Filesize

        72KB

      • memory/4712-8-0x0000000006080000-0x0000000006088000-memory.dmp

        Filesize

        32KB

      • memory/4712-9-0x0000000006090000-0x000000000609C000-memory.dmp

        Filesize

        48KB

      • memory/4712-10-0x00000000060E0000-0x0000000006164000-memory.dmp

        Filesize

        528KB

      • memory/4712-0-0x00000000751FE000-0x00000000751FF000-memory.dmp

        Filesize

        4KB

      • memory/4712-6-0x00000000751F0000-0x00000000759A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4712-5-0x0000000005070000-0x000000000510C000-memory.dmp

        Filesize

        624KB

      • memory/4712-3-0x0000000004E20000-0x0000000004EB2000-memory.dmp

        Filesize

        584KB

      • memory/4712-45-0x00000000751F0000-0x00000000759A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4712-2-0x00000000053D0000-0x0000000005974000-memory.dmp

        Filesize

        5.6MB

      • memory/4712-1-0x0000000000300000-0x00000000003A8000-memory.dmp

        Filesize

        672KB

      • memory/4748-15-0x00000000027E0000-0x0000000002816000-memory.dmp

        Filesize

        216KB

      • memory/4748-71-0x0000000007A40000-0x00000000080BA000-memory.dmp

        Filesize

        6.5MB

      • memory/4748-22-0x00000000751F0000-0x00000000759A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4748-23-0x0000000005940000-0x0000000005C94000-memory.dmp

        Filesize

        3.3MB

      • memory/4748-19-0x00000000057E0000-0x0000000005846000-memory.dmp

        Filesize

        408KB

      • memory/4748-20-0x0000000005850000-0x00000000058B6000-memory.dmp

        Filesize

        408KB

      • memory/4748-46-0x00000000060D0000-0x00000000060EE000-memory.dmp

        Filesize

        120KB

      • memory/4748-47-0x0000000006160000-0x00000000061AC000-memory.dmp

        Filesize

        304KB

      • memory/4748-48-0x0000000007080000-0x00000000070B2000-memory.dmp

        Filesize

        200KB

      • memory/4748-49-0x0000000075AA0000-0x0000000075AEC000-memory.dmp

        Filesize

        304KB

      • memory/4748-16-0x00000000751F0000-0x00000000759A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4748-60-0x00000000072C0000-0x0000000007363000-memory.dmp

        Filesize

        652KB

      • memory/4748-59-0x0000000007040000-0x000000000705E000-memory.dmp

        Filesize

        120KB

      • memory/4748-18-0x0000000005100000-0x0000000005122000-memory.dmp

        Filesize

        136KB

      • memory/4748-72-0x00000000073F0000-0x000000000740A000-memory.dmp

        Filesize

        104KB

      • memory/4748-73-0x0000000007470000-0x000000000747A000-memory.dmp

        Filesize

        40KB

      • memory/4748-85-0x00000000751F0000-0x00000000759A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4748-75-0x00000000075F0000-0x0000000007601000-memory.dmp

        Filesize

        68KB

      • memory/4748-17-0x00000000051B0000-0x00000000057D8000-memory.dmp

        Filesize

        6.2MB

      • memory/4748-77-0x0000000007630000-0x0000000007644000-memory.dmp

        Filesize

        80KB

      • memory/4748-21-0x00000000751F0000-0x00000000759A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4748-79-0x0000000007710000-0x0000000007718000-memory.dmp

        Filesize

        32KB

      • memory/4808-78-0x00000000074E0000-0x00000000074FA000-memory.dmp

        Filesize

        104KB

      • memory/4808-76-0x00000000073D0000-0x00000000073DE000-memory.dmp

        Filesize

        56KB

      • memory/4808-74-0x0000000007420000-0x00000000074B6000-memory.dmp

        Filesize

        600KB

      • memory/4808-61-0x0000000075AA0000-0x0000000075AEC000-memory.dmp

        Filesize

        304KB