Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-09-2024 08:16

General

  • Target

    eFatura_ETN2024000000575_Ekleri.exe

  • Size

    647KB

  • MD5

    35afa9c536b9743ed6bf8615d5fe823b

  • SHA1

    36f9ec8c68391760bbaebd0f4555bb4cabb0ae32

  • SHA256

    b70065cfa09b2db420f89631e95a49daf021760dda72d34b5d57c232ac4fb48d

  • SHA512

    894d8785d0de941969d04a2f4b584e3a7286845866787e321167bfbc03c204555a89eedfe34215a18941074e798152d9349e8add56ed087d562e47d653d7de1e

  • SSDEEP

    12288:Gvi9i72la8/Tm3rmH+m9toq19b0SlVg/1ti3taZsOoFtOcjrgovukbKJ9WCQhiZE:/kE9636XDbBg9Y3tydoF5jrrtbQ9lAi+

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    zqamcx.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Methodman991

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eFatura_ETN2024000000575_Ekleri.exe
    "C:\Users\Admin\AppData\Local\Temp\eFatura_ETN2024000000575_Ekleri.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1560
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\eFatura_ETN2024000000575_Ekleri.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4616
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mnikYmkIu.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4964
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mnikYmkIu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp34C7.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:4456
    • C:\Users\Admin\AppData\Local\Temp\eFatura_ETN2024000000575_Ekleri.exe
      "C:\Users\Admin\AppData\Local\Temp\eFatura_ETN2024000000575_Ekleri.exe"
      2⤵
        PID:1848
      • C:\Users\Admin\AppData\Local\Temp\eFatura_ETN2024000000575_Ekleri.exe
        "C:\Users\Admin\AppData\Local\Temp\eFatura_ETN2024000000575_Ekleri.exe"
        2⤵
          PID:1808
        • C:\Users\Admin\AppData\Local\Temp\eFatura_ETN2024000000575_Ekleri.exe
          "C:\Users\Admin\AppData\Local\Temp\eFatura_ETN2024000000575_Ekleri.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:3248

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        968cb9309758126772781b83adb8a28f

        SHA1

        8da30e71accf186b2ba11da1797cf67f8f78b47c

        SHA256

        92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

        SHA512

        4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        18KB

        MD5

        4c3d7834bbff22842fc00f6d3f4ed61a

        SHA1

        9d6db1ef882c30ed64c1ff57125c7910e80ab500

        SHA256

        f4fa1ded736540c7688791a29772204e04f041e9a77f297d759f20fc275b1b31

        SHA512

        a099adae577b7126f4e64037dc6eb74d26bcbb5ed8bbb8a6b0dfb20b6cf3dc86a3d0cf099e082380cc93878e253f59c9d8054c69a17efcb8aa10689fa02ed356

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zqgjn33e.ro4.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\tmp34C7.tmp

        Filesize

        1KB

        MD5

        c5abd328132adea70a9e9395a623deea

        SHA1

        f4d57c69a6ac7e5fc0ae9c4a7d88078137d6d65d

        SHA256

        9c8faf3115abc050f2a5a9ad600a149d71e8b4147e99cd6a3c74e79676d75364

        SHA512

        2bbeebdfbecba13f7f0fefd6316862319dd06c0de8241f34ab4857f404ab6e8e1bcdf3a94ab8fc03127beef45edbbd66ed71fd53411429db69f276d2de5d2d76

      • memory/1560-8-0x00000000744F0000-0x0000000074CA0000-memory.dmp

        Filesize

        7.7MB

      • memory/1560-2-0x0000000005480000-0x0000000005A24000-memory.dmp

        Filesize

        5.6MB

      • memory/1560-6-0x0000000005470000-0x0000000005480000-memory.dmp

        Filesize

        64KB

      • memory/1560-7-0x00000000744FE000-0x00000000744FF000-memory.dmp

        Filesize

        4KB

      • memory/1560-4-0x00000000744F0000-0x0000000074CA0000-memory.dmp

        Filesize

        7.7MB

      • memory/1560-9-0x0000000006630000-0x00000000066B4000-memory.dmp

        Filesize

        528KB

      • memory/1560-10-0x0000000008C70000-0x0000000008D0C000-memory.dmp

        Filesize

        624KB

      • memory/1560-1-0x0000000000550000-0x00000000005F4000-memory.dmp

        Filesize

        656KB

      • memory/1560-0-0x00000000744FE000-0x00000000744FF000-memory.dmp

        Filesize

        4KB

      • memory/1560-3-0x0000000004FD0000-0x0000000005062000-memory.dmp

        Filesize

        584KB

      • memory/1560-5-0x0000000005180000-0x000000000518A000-memory.dmp

        Filesize

        40KB

      • memory/1560-48-0x00000000744F0000-0x0000000074CA0000-memory.dmp

        Filesize

        7.7MB

      • memory/3248-46-0x0000000000400000-0x0000000000442000-memory.dmp

        Filesize

        264KB

      • memory/3248-90-0x0000000006570000-0x00000000065C0000-memory.dmp

        Filesize

        320KB

      • memory/4616-16-0x00000000744F0000-0x0000000074CA0000-memory.dmp

        Filesize

        7.7MB

      • memory/4616-17-0x0000000005150000-0x0000000005778000-memory.dmp

        Filesize

        6.2MB

      • memory/4616-22-0x0000000004FA0000-0x0000000004FC2000-memory.dmp

        Filesize

        136KB

      • memory/4616-24-0x0000000005830000-0x0000000005896000-memory.dmp

        Filesize

        408KB

      • memory/4616-15-0x0000000002530000-0x0000000002566000-memory.dmp

        Filesize

        216KB

      • memory/4616-25-0x00000000744F0000-0x0000000074CA0000-memory.dmp

        Filesize

        7.7MB

      • memory/4616-89-0x00000000744F0000-0x0000000074CA0000-memory.dmp

        Filesize

        7.7MB

      • memory/4616-75-0x0000000006F70000-0x0000000006F8A000-memory.dmp

        Filesize

        104KB

      • memory/4616-23-0x0000000005040000-0x00000000050A6000-memory.dmp

        Filesize

        408KB

      • memory/4616-49-0x0000000005E50000-0x0000000005E6E000-memory.dmp

        Filesize

        120KB

      • memory/4616-50-0x0000000006230000-0x000000000627C000-memory.dmp

        Filesize

        304KB

      • memory/4616-18-0x00000000744F0000-0x0000000074CA0000-memory.dmp

        Filesize

        7.7MB

      • memory/4616-53-0x0000000074DA0000-0x0000000074DEC000-memory.dmp

        Filesize

        304KB

      • memory/4616-82-0x00000000074A0000-0x00000000074A8000-memory.dmp

        Filesize

        32KB

      • memory/4616-77-0x0000000007400000-0x0000000007496000-memory.dmp

        Filesize

        600KB

      • memory/4616-73-0x0000000006E50000-0x0000000006EF3000-memory.dmp

        Filesize

        652KB

      • memory/4964-19-0x00000000744F0000-0x0000000074CA0000-memory.dmp

        Filesize

        7.7MB

      • memory/4964-74-0x0000000007760000-0x0000000007DDA000-memory.dmp

        Filesize

        6.5MB

      • memory/4964-76-0x0000000007180000-0x000000000718A000-memory.dmp

        Filesize

        40KB

      • memory/4964-72-0x0000000006360000-0x000000000637E000-memory.dmp

        Filesize

        120KB

      • memory/4964-78-0x0000000007310000-0x0000000007321000-memory.dmp

        Filesize

        68KB

      • memory/4964-79-0x0000000007340000-0x000000000734E000-memory.dmp

        Filesize

        56KB

      • memory/4964-80-0x0000000007350000-0x0000000007364000-memory.dmp

        Filesize

        80KB

      • memory/4964-81-0x0000000007450000-0x000000000746A000-memory.dmp

        Filesize

        104KB

      • memory/4964-52-0x0000000074DA0000-0x0000000074DEC000-memory.dmp

        Filesize

        304KB

      • memory/4964-51-0x0000000006380000-0x00000000063B2000-memory.dmp

        Filesize

        200KB

      • memory/4964-36-0x0000000005850000-0x0000000005BA4000-memory.dmp

        Filesize

        3.3MB

      • memory/4964-88-0x00000000744F0000-0x0000000074CA0000-memory.dmp

        Filesize

        7.7MB

      • memory/4964-20-0x00000000744F0000-0x0000000074CA0000-memory.dmp

        Filesize

        7.7MB

      • memory/4964-26-0x00000000744F0000-0x0000000074CA0000-memory.dmp

        Filesize

        7.7MB