Analysis

  • max time kernel
    111s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12-09-2024 01:35

General

  • Target

    5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe

  • Size

    639KB

  • MD5

    29ef191ed82ea8c11cf1f99695ea0faf

  • SHA1

    e9e71a843dec6db3f47f1d7b5c25044761e378d9

  • SHA256

    5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26

  • SHA512

    51d405194b0be85e75c0af8349e2585cc70ccadff7f2e54cb63cd6ef46b923e59907b0f0ef0318958bea87cf34e8441afe59c625cc781c78f16926186e50c476

  • SSDEEP

    12288:7a7kvHzL2pOM7a1t0B51zwIkIGGvtmRM1SHTl7MKAdfwr2lCACZ5ymmkR:7aoHTsGIkCcRMQHOKGIreg5yQ

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe
    "C:\Users\Admin\AppData\Local\Temp\5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2564
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2724
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BLSHXnJWplNm.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2828
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLSHXnJWplNm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFB02.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2876
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpFB02.tmp

    Filesize

    1KB

    MD5

    3b29a4221dca2bb656e2cc6c52087566

    SHA1

    8ed7ecfe1adb23d9421df6f59b4a204a699b0861

    SHA256

    e8ec4821443bc6acda192b37a89039ec9a13dede723f912df28cb1651bb89473

    SHA512

    d685ad4902fec5eb2b16148a99a63d87cf1a16760417108a168730194c6a3dc24a6f963094c1f62891dedbd5dbcfdef98aba9c66840b3f8f8dfc94d2bcd17bae

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    4411ce5fd5b733216422a69419b4eb9f

    SHA1

    ce70258356ff508029c2118c16d250d41a0dd7d7

    SHA256

    170ca2935c244364ab68e9aa8bdddeaa8c4f4318beca586092a63fe71848afc0

    SHA512

    5f6a6df5dec48a3072c3bb84d51f0d88545a2771717449f6d1432dd171df8f3ca6b854e93ca28ee3f84603934398eddda53f078c8e75cf348f1b4eb69ff1468a

  • memory/2564-4-0x0000000074BCE000-0x0000000074BCF000-memory.dmp

    Filesize

    4KB

  • memory/2564-32-0x0000000074BC0000-0x00000000752AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2564-0-0x0000000074BCE000-0x0000000074BCF000-memory.dmp

    Filesize

    4KB

  • memory/2564-5-0x0000000074BC0000-0x00000000752AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2564-6-0x0000000005020000-0x00000000050A4000-memory.dmp

    Filesize

    528KB

  • memory/2564-2-0x0000000074BC0000-0x00000000752AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2564-1-0x0000000001320000-0x00000000013C2000-memory.dmp

    Filesize

    648KB

  • memory/2564-3-0x00000000003C0000-0x00000000003D0000-memory.dmp

    Filesize

    64KB

  • memory/2668-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2668-31-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2668-28-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2668-25-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2668-23-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2668-21-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2668-19-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2668-29-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB