Analysis
-
max time kernel
150s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 14:06
Static task
static1
Behavioral task
behavioral1
Sample
IlluminatiFree.exe
Resource
win7-20240708-en
General
-
Target
IlluminatiFree.exe
-
Size
3.4MB
-
MD5
0d2b81676d5454aa2d64f4e3d5492065
-
SHA1
da217be8be81f371c35c949b067306d58bc7edc4
-
SHA256
3159c15e685d17e6349b5b23487380cfa8b2f18a0d8e6db72b5a64ef6eb0a694
-
SHA512
d92805b3cdc418b22a31439b4d494d014c15b58500af028f8398a006dac0c71e264e30ae25007a3662bac10eb02337db0e5974bdc94971df88d639070a3e6b34
-
SSDEEP
98304:RtZ1Bb/WtqjM/ECMPXpJxPDREVUTpybRyVpKGXdfW1c:T/E04/FMPXLl2WyRop7Xdfd
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4008-7-0x0000000006550000-0x0000000006764000-memory.dmp family_agenttesla -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
IlluminatiFree.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation IlluminatiFree.exe -
Executes dropped EXE 1 IoCs
Processes:
trigger.exepid process 2368 trigger.exe -
Drops file in Windows directory 2 IoCs
Processes:
IlluminatiFree.exedescription ioc process File created C:\Windows\triggerbot.exe IlluminatiFree.exe File created C:\Windows\trigger.exe IlluminatiFree.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
IlluminatiFree.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IlluminatiFree.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
IlluminatiFree.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS IlluminatiFree.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer IlluminatiFree.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion IlluminatiFree.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
IlluminatiFree.exepid process 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe 4008 IlluminatiFree.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
trigger.exepid process 2368 trigger.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
IlluminatiFree.exedescription pid process Token: SeDebugPrivilege 4008 IlluminatiFree.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
trigger.exepid process 2368 trigger.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
trigger.exepid process 2368 trigger.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
trigger.exepid process 2368 trigger.exe 2368 trigger.exe 2368 trigger.exe 2368 trigger.exe 2368 trigger.exe 2368 trigger.exe 2368 trigger.exe 2368 trigger.exe 2368 trigger.exe 2368 trigger.exe 2368 trigger.exe 2368 trigger.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
IlluminatiFree.exedescription pid process target process PID 4008 wrote to memory of 2368 4008 IlluminatiFree.exe trigger.exe PID 4008 wrote to memory of 2368 4008 IlluminatiFree.exe trigger.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IlluminatiFree.exe"C:\Users\Admin\AppData\Local\Temp\IlluminatiFree.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\trigger.exe"C:\Windows\trigger.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\trigger.exeFilesize
1.2MB
MD52d6b9e9c268c8746c0a94a47417c28d4
SHA14c0c418fd2ba68ddfa1de1c06c3e1516c4be297e
SHA256f2a79c6855148ab387b4614f445f29f6d9de8a034b1051696ed695d665731ad1
SHA51245709d73fc6571af1db952ee7c84b93a47168002215bed8420653a62066aa934bdee4098014e3182153f8010121f90a7b9df8aaaa03ba3cb0d834ca76a373c58
-
memory/4008-6-0x0000000006400000-0x000000000640A000-memory.dmpFilesize
40KB
-
memory/4008-2-0x0000000074A30000-0x00000000751E0000-memory.dmpFilesize
7.7MB
-
memory/4008-3-0x0000000005D80000-0x000000000605E000-memory.dmpFilesize
2.9MB
-
memory/4008-4-0x00000000078A0000-0x0000000007E44000-memory.dmpFilesize
5.6MB
-
memory/4008-5-0x0000000006060000-0x00000000060F2000-memory.dmpFilesize
584KB
-
memory/4008-0-0x0000000074A3E000-0x0000000074A3F000-memory.dmpFilesize
4KB
-
memory/4008-7-0x0000000006550000-0x0000000006764000-memory.dmpFilesize
2.1MB
-
memory/4008-8-0x0000000074A30000-0x00000000751E0000-memory.dmpFilesize
7.7MB
-
memory/4008-9-0x0000000074A3E000-0x0000000074A3F000-memory.dmpFilesize
4KB
-
memory/4008-10-0x0000000074A30000-0x00000000751E0000-memory.dmpFilesize
7.7MB
-
memory/4008-11-0x0000000074A30000-0x00000000751E0000-memory.dmpFilesize
7.7MB
-
memory/4008-1-0x0000000000D00000-0x0000000001074000-memory.dmpFilesize
3.5MB