Analysis
- max time kernel
52s - max time network
56s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
20/06/2024, 01:26
General
- Target 556ef0a9dc3b216ee75fd880eb3ec7791a763411210442c423653ecd30b2a364.exe
- Size 716KB
- Sample240620-btmkds1dkd
- SHA256 556ef0a9dc3b216ee75fd880eb3ec7791a763411210442c423653ecd30b2a364
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.merlinmotorworks.com
-
Port
587
-
Username
-
Password
Merlin1080S
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\556ef0a9dc3b216ee75fd880eb3ec7791a763411210442c423653ecd30b2a364.exe"C:\Users\Admin\AppData\Local\Temp\556ef0a9dc3b216ee75fd880eb3ec7791a763411210442c423653ecd30b2a364.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\556ef0a9dc3b216ee75fd880eb3ec7791a763411210442c423653ecd30b2a364.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NZBKZxLkiTJnk.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NZBKZxLkiTJnk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBEAC.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\556ef0a9dc3b216ee75fd880eb3ec7791a763411210442c423653ecd30b2a364.exe"C:\Users\Admin\AppData\Local\Temp\556ef0a9dc3b216ee75fd880eb3ec7791a763411210442c423653ecd30b2a364.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_gjizzxsm.nfi.ps1
tmpBEAC.tmp
memory/372-7-0x0000000005300000-0x0000000005310000-memory.dmp
memory/372-3-0x0000000004FB0000-0x0000000005042000-memory.dmp
memory/372-6-0x0000000005430000-0x0000000005452000-memory.dmp
memory/372-49-0x0000000074B80000-0x0000000075330000-memory.dmp
memory/372-8-0x00000000064F0000-0x0000000006574000-memory.dmp
memory/372-9-0x0000000007BF0000-0x0000000007C8C000-memory.dmp
memory/372-10-0x0000000074B8E000-0x0000000074B8F000-memory.dmp
memory/372-11-0x0000000074B80000-0x0000000075330000-memory.dmp
memory/372-0-0x0000000074B8E000-0x0000000074B8F000-memory.dmp
memory/372-1-0x0000000000510000-0x00000000005C6000-memory.dmp
memory/372-4-0x0000000005160000-0x000000000516A000-memory.dmp
memory/372-5-0x0000000074B80000-0x0000000075330000-memory.dmp
memory/372-2-0x0000000005480000-0x0000000005A24000-memory.dmp
memory/688-78-0x0000000007130000-0x0000000007141000-memory.dmp
memory/688-24-0x0000000074B80000-0x0000000075330000-memory.dmp
memory/688-20-0x0000000074B80000-0x0000000075330000-memory.dmp
memory/688-74-0x0000000007580000-0x0000000007BFA000-memory.dmp
memory/688-75-0x0000000006F30000-0x0000000006F4A000-memory.dmp
memory/688-73-0x0000000006E00000-0x0000000006EA3000-memory.dmp
memory/688-42-0x0000000074B80000-0x0000000075330000-memory.dmp
memory/688-89-0x0000000074B80000-0x0000000075330000-memory.dmp
memory/688-53-0x00000000700E0000-0x000000007012C000-memory.dmp
memory/688-48-0x0000000005C00000-0x0000000005C1E000-memory.dmp
memory/688-50-0x0000000005CF0000-0x0000000005D3C000-memory.dmp
memory/2136-16-0x0000000002510000-0x0000000002546000-memory.dmp
memory/2136-77-0x00000000073B0000-0x0000000007446000-memory.dmp
memory/2136-52-0x00000000700E0000-0x000000007012C000-memory.dmp
memory/2136-51-0x00000000063F0000-0x0000000006422000-memory.dmp
memory/2136-22-0x0000000005590000-0x00000000055F6000-memory.dmp
memory/2136-72-0x00000000063B0000-0x00000000063CE000-memory.dmp
memory/2136-23-0x00000000057B0000-0x0000000005816000-memory.dmp
memory/2136-30-0x0000000005820000-0x0000000005B74000-memory.dmp
memory/2136-76-0x00000000071A0000-0x00000000071AA000-memory.dmp
memory/2136-17-0x0000000074B80000-0x0000000075330000-memory.dmp
memory/2136-21-0x0000000004E40000-0x0000000004E62000-memory.dmp
memory/2136-79-0x0000000007360000-0x000000000736E000-memory.dmp
memory/2136-80-0x0000000007370000-0x0000000007384000-memory.dmp
memory/2136-81-0x0000000007470000-0x000000000748A000-memory.dmp
memory/2136-82-0x0000000007450000-0x0000000007458000-memory.dmp
memory/2136-19-0x0000000074B80000-0x0000000075330000-memory.dmp
memory/2136-18-0x0000000004EF0000-0x0000000005518000-memory.dmp
memory/2136-88-0x0000000074B80000-0x0000000075330000-memory.dmp
memory/4392-46-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4392-90-0x0000000006FA0000-0x0000000006FF0000-memory.dmp