Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
20/06/2024, 01:33
General
- Target order_document_sheet#PO35642.js
- Size 576KB
- Sample240620-by1b2s1erg
- SHA256 0ffef02908f711dc3b01b83a439e2aeaafa58b021a4c930ed47772e6d958931e
Malware Config
Extracted
-
xworm
-
5.0
-
107.175.101.198:7000
-
dvNrQCwanoQ9ouuD
-
install_file
USB.exe
Extracted
-
agenttesla
-
https://api.telegram.org/bot6410198048:AAGgeWnhGxZeYMKJkRauoOJwGKdxJztyd4k/
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Detect Xworm Payload 1 IoCs
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
- Detects executables packed with SmartAssembly 1 IoCs
- Detects executables referencing Windows vault credential objects. Observed in infostealers 2 IoCs
- Detects executables referencing credit card regular expressions 1 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
- Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
- Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe"C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hmpDqhdDQk.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hmpDqhdDQk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8ABB.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe"C:\Users\Admin\AppData\Local\Temp\order_document_sheet#PO35642.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 23484⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1248 -ip 12481⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_iqixrk0n.upz.ps1
order_document_sheet#PO35642.exe
tmp8ABB.tmp
memory/1248-99-0x0000000007990000-0x00000000079DC000-memory.dmp
memory/1248-98-0x00000000075E0000-0x0000000007934000-memory.dmp
memory/1248-97-0x00000000074B0000-0x00000000075D0000-memory.dmp
memory/1248-96-0x0000000007460000-0x00000000074B0000-memory.dmp
memory/1248-95-0x00000000062F0000-0x0000000006332000-memory.dmp
memory/1248-33-0x0000000000400000-0x000000000040E000-memory.dmp
memory/3856-82-0x0000000006F00000-0x0000000006F1A000-memory.dmp
memory/3856-80-0x0000000006DC0000-0x0000000006E63000-memory.dmp
memory/3856-59-0x0000000075AF0000-0x0000000075B3C000-memory.dmp
memory/3856-57-0x0000000005C70000-0x0000000005CBC000-memory.dmp
memory/3856-29-0x0000000004C20000-0x0000000004C42000-memory.dmp
memory/3856-58-0x0000000006B80000-0x0000000006BB2000-memory.dmp
memory/3856-84-0x0000000007180000-0x0000000007216000-memory.dmp
memory/3856-35-0x0000000005600000-0x0000000005954000-memory.dmp
memory/3856-85-0x0000000007100000-0x0000000007111000-memory.dmp
memory/3856-31-0x0000000005490000-0x00000000054F6000-memory.dmp
memory/3856-30-0x00000000053B0000-0x0000000005416000-memory.dmp
memory/4260-21-0x0000000006C30000-0x0000000006C80000-memory.dmp
memory/4260-17-0x0000000005BD0000-0x0000000005C6C000-memory.dmp
memory/4260-55-0x0000000075260000-0x0000000075A10000-memory.dmp
memory/4260-32-0x000000007526E000-0x000000007526F000-memory.dmp
memory/4260-11-0x000000007526E000-0x000000007526F000-memory.dmp
memory/4260-12-0x0000000000F00000-0x0000000000F72000-memory.dmp
memory/4260-13-0x0000000005E10000-0x00000000063B4000-memory.dmp
memory/4260-14-0x0000000005960000-0x00000000059F2000-memory.dmp
memory/4260-16-0x0000000075260000-0x0000000075A10000-memory.dmp
memory/4260-20-0x0000000005DF0000-0x0000000005DFC000-memory.dmp
memory/4260-15-0x0000000005B20000-0x0000000005B2A000-memory.dmp
memory/4260-19-0x0000000005DE0000-0x0000000005DE8000-memory.dmp
memory/4260-18-0x0000000005CA0000-0x0000000005CB2000-memory.dmp
memory/4344-79-0x0000000006780000-0x000000000679E000-memory.dmp
memory/4344-87-0x0000000007740000-0x0000000007754000-memory.dmp
memory/4344-88-0x0000000007840000-0x000000000785A000-memory.dmp
memory/4344-89-0x0000000007820000-0x0000000007828000-memory.dmp
memory/4344-86-0x0000000007730000-0x000000000773E000-memory.dmp
memory/4344-83-0x0000000007570000-0x000000000757A000-memory.dmp
memory/4344-81-0x0000000007B50000-0x00000000081CA000-memory.dmp
memory/4344-26-0x00000000028D0000-0x0000000002906000-memory.dmp
memory/4344-56-0x00000000061E0000-0x00000000061FE000-memory.dmp
memory/4344-27-0x00000000055E0000-0x0000000005C08000-memory.dmp
memory/4344-60-0x0000000075AF0000-0x0000000075B3C000-memory.dmp