Analysis
- max time kernel
137s - max time network
120s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
24/07/2024, 23:41
General
- Target LisectAVT_2403002A_133.exe
- Size 729KB
- Sample240724-3pfd3athnr
- SHA256 1a38e29dff73f042b8abb0ed1398a37eefa8fe3f6030e27a9a22b8964263b146
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.kabeercommodities.com
-
Port
587
-
Username
-
Password
w{A6H.o&sz%g
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.kabeercommodities.com
-
Port
587
-
Username
-
Password
w{A6H.o&sz%g
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002A_133.exe"C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002A_133.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002A_133.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GlIToApjgGEL.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlIToApjgGEL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE455.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002A_133.exe"C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002A_133.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_xq0f4n4q.4kz.ps1
tmpE455.tmp
memory/948-44-0x0000000075030000-0x00000000757E0000-memory.dmp
memory/948-2-0x0000000005870000-0x0000000005E14000-memory.dmp
memory/948-5-0x00000000057F0000-0x00000000057FA000-memory.dmp
memory/948-7-0x0000000008340000-0x00000000083DC000-memory.dmp
memory/948-8-0x00000000083E0000-0x00000000083F2000-memory.dmp
memory/948-9-0x0000000006780000-0x000000000678C000-memory.dmp
memory/948-10-0x0000000008440000-0x00000000084C2000-memory.dmp
memory/948-0-0x000000007503E000-0x000000007503F000-memory.dmp
memory/948-6-0x0000000075030000-0x00000000757E0000-memory.dmp
memory/948-4-0x0000000005460000-0x00000000057B4000-memory.dmp
memory/948-1-0x0000000000810000-0x00000000008CC000-memory.dmp
memory/948-3-0x00000000052C0000-0x0000000005352000-memory.dmp
memory/1744-80-0x0000000007890000-0x00000000078AA000-memory.dmp
memory/1744-88-0x0000000075030000-0x00000000757E0000-memory.dmp
memory/1744-22-0x0000000075030000-0x00000000757E0000-memory.dmp
memory/1744-23-0x0000000075030000-0x00000000757E0000-memory.dmp
memory/1744-73-0x0000000007BA0000-0x000000000821A000-memory.dmp
memory/1744-81-0x0000000007870000-0x0000000007878000-memory.dmp
memory/1744-31-0x0000000005B40000-0x0000000005BA6000-memory.dmp
memory/1744-33-0x0000000005C20000-0x0000000005C86000-memory.dmp
memory/1744-76-0x00000000077D0000-0x0000000007866000-memory.dmp
memory/1744-20-0x0000000075030000-0x00000000757E0000-memory.dmp
memory/1744-77-0x0000000007750000-0x0000000007761000-memory.dmp
memory/1744-79-0x0000000007790000-0x00000000077A4000-memory.dmp
memory/1744-51-0x0000000071480000-0x00000000714CC000-memory.dmp
memory/1744-50-0x0000000006800000-0x0000000006832000-memory.dmp
memory/1744-61-0x00000000067E0000-0x00000000067FE000-memory.dmp
memory/1744-78-0x0000000007780000-0x000000000778E000-memory.dmp
memory/1744-72-0x0000000007400000-0x00000000074A3000-memory.dmp
memory/2432-89-0x0000000006F00000-0x0000000006F50000-memory.dmp
memory/2432-24-0x0000000000400000-0x0000000000440000-memory.dmp
memory/4168-15-0x00000000021B0000-0x00000000021E6000-memory.dmp
memory/4168-75-0x0000000006E70000-0x0000000006E7A000-memory.dmp
memory/4168-74-0x0000000006E00000-0x0000000006E1A000-memory.dmp
memory/4168-62-0x0000000071480000-0x00000000714CC000-memory.dmp
memory/4168-49-0x0000000005B70000-0x0000000005BBC000-memory.dmp
memory/4168-48-0x0000000005AE0000-0x0000000005AFE000-memory.dmp
memory/4168-25-0x0000000004C20000-0x0000000004C42000-memory.dmp
memory/4168-19-0x0000000075030000-0x00000000757E0000-memory.dmp
memory/4168-87-0x0000000075030000-0x00000000757E0000-memory.dmp
memory/4168-18-0x0000000075030000-0x00000000757E0000-memory.dmp
memory/4168-17-0x0000000004CB0000-0x00000000052D8000-memory.dmp
memory/4168-16-0x0000000075030000-0x00000000757E0000-memory.dmp