Analysis
- max time kernel
139s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
20/06/2024, 01:59
General
- Target b5e021149493ec7563afdabb07923d68132015c4016fde720710a5eb8a8a818d.exe
- Size 675KB
- Sample240620-cetwlasena
- SHA256 b5e021149493ec7563afdabb07923d68132015c4016fde720710a5eb8a8a818d
Malware Config
Extracted
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
ikfbqqfmgcqnrjzj
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
ikfbqqfmgcqnrjzj
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5e021149493ec7563afdabb07923d68132015c4016fde720710a5eb8a8a818d.exe"C:\Users\Admin\AppData\Local\Temp\b5e021149493ec7563afdabb07923d68132015c4016fde720710a5eb8a8a818d.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QTadPOLdZs.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QTadPOLdZs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp87BE.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\b5e021149493ec7563afdabb07923d68132015c4016fde720710a5eb8a8a818d.exe"C:\Users\Admin\AppData\Local\Temp\b5e021149493ec7563afdabb07923d68132015c4016fde720710a5eb8a8a818d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_t5e4v2qv.4da.ps1
tmp87BE.tmp
memory/1984-68-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/1984-28-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/1984-20-0x0000000000400000-0x0000000000444000-memory.dmp
memory/1984-39-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/1984-60-0x0000000006850000-0x00000000068A0000-memory.dmp
memory/2164-5-0x0000000005C00000-0x0000000005C0A000-memory.dmp
memory/2164-8-0x0000000005DF0000-0x0000000005DF8000-memory.dmp
memory/2164-9-0x0000000005F80000-0x0000000005F8C000-memory.dmp
memory/2164-10-0x0000000006E40000-0x0000000006EC6000-memory.dmp
memory/2164-15-0x0000000074D0E000-0x0000000074D0F000-memory.dmp
memory/2164-7-0x0000000005DC0000-0x0000000005DD2000-memory.dmp
memory/2164-6-0x0000000005CB0000-0x0000000005D4C000-memory.dmp
memory/2164-0-0x0000000074D0E000-0x0000000074D0F000-memory.dmp
memory/2164-4-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/2164-3-0x0000000005A30000-0x0000000005AC2000-memory.dmp
memory/2164-2-0x0000000005FE0000-0x0000000006584000-memory.dmp
memory/2164-26-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/2164-1-0x0000000000FA0000-0x000000000104C000-memory.dmp
memory/5080-27-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/5080-55-0x0000000007860000-0x0000000007EDA000-memory.dmp
memory/5080-24-0x0000000004EC0000-0x0000000004F26000-memory.dmp
memory/5080-25-0x00000000050A0000-0x0000000005106000-memory.dmp
memory/5080-21-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/5080-29-0x0000000005960000-0x0000000005CB4000-memory.dmp
memory/5080-19-0x0000000005330000-0x0000000005958000-memory.dmp
memory/5080-40-0x0000000005EF0000-0x0000000005F0E000-memory.dmp
memory/5080-41-0x0000000005FD0000-0x000000000601C000-memory.dmp
memory/5080-42-0x00000000064B0000-0x00000000064E2000-memory.dmp
memory/5080-43-0x0000000070A20000-0x0000000070A6C000-memory.dmp
memory/5080-53-0x0000000006490000-0x00000000064AE000-memory.dmp
memory/5080-54-0x0000000006ED0000-0x0000000006F73000-memory.dmp
memory/5080-23-0x0000000004E20000-0x0000000004E42000-memory.dmp
memory/5080-56-0x0000000007220000-0x000000000723A000-memory.dmp
memory/5080-57-0x0000000007290000-0x000000000729A000-memory.dmp
memory/5080-58-0x00000000074A0000-0x0000000007536000-memory.dmp
memory/5080-59-0x0000000007420000-0x0000000007431000-memory.dmp
memory/5080-18-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/5080-61-0x0000000007450000-0x000000000745E000-memory.dmp
memory/5080-62-0x0000000007460000-0x0000000007474000-memory.dmp
memory/5080-63-0x0000000007560000-0x000000000757A000-memory.dmp
memory/5080-64-0x0000000007540000-0x0000000007548000-memory.dmp
memory/5080-67-0x0000000074D00000-0x00000000754B0000-memory.dmp
memory/5080-16-0x00000000025C0000-0x00000000025F6000-memory.dmp