General
-
Target
ASW.exe
-
Size
2.3MB
-
Sample
240913-yf1anavemp
-
MD5
634121b2af66dd5433c1155702abc84c
-
SHA1
f3fd2a1800c4272bdf8209ff47e3703a4923e699
-
SHA256
499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f
-
SHA512
60786abdb281fe3f4fc4e242434fb280271684f13b683dc9cd32ac1a6e29ba496cea2c22ee1a82fa9dd6896f6530e9a0c07e2245ee35fc6100f7d684623bc805
-
SSDEEP
12288:tuEAmDY2kyLG/XModp1HmKwHfX7ZWezHiLfdHcWJWnVMaKo9Nip2IiUlbtgfXD70:cM9y3QvpHiLFcVVMaP9Nip7lbtgfT70
Static task
static1
Behavioral task
behavioral1
Sample
ASW.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ASW.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.fosna.net - Port:
21 - Username:
[email protected] - Password:
u;4z3V.Iir1l
Extracted
Protocol: ftp- Host:
ftp.fosna.net - Port:
21 - Username:
[email protected] - Password:
u;4z3V.Iir1l
Targets
-
-
Target
ASW.exe
-
Size
2.3MB
-
MD5
634121b2af66dd5433c1155702abc84c
-
SHA1
f3fd2a1800c4272bdf8209ff47e3703a4923e699
-
SHA256
499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f
-
SHA512
60786abdb281fe3f4fc4e242434fb280271684f13b683dc9cd32ac1a6e29ba496cea2c22ee1a82fa9dd6896f6530e9a0c07e2245ee35fc6100f7d684623bc805
-
SSDEEP
12288:tuEAmDY2kyLG/XModp1HmKwHfX7ZWezHiLfdHcWJWnVMaKo9Nip2IiUlbtgfXD70:cM9y3QvpHiLFcVVMaP9Nip7lbtgfT70
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Looks for VirtualBox Guest Additions in registry
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4Virtualization/Sandbox Evasion
2