Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16-09-2024 08:57
Static task
static1
Behavioral task
behavioral1
Sample
Documenti di spedizione 00039488580006996960.bat.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Documenti di spedizione 00039488580006996960.bat.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
General
-
Target
Documenti di spedizione 00039488580006996960.bat.exe
-
Size
752KB
-
MD5
74b63fc7533ba2dfd75253a2ac5044f9
-
SHA1
20c6f4f4db0e850f1506e7d89be267f2fa1b21e2
-
SHA256
fbcceeb087e972ef29b0e3561a022aa4e6897cd78de77049e130e47bafcde554
-
SHA512
ff82f9a7138fce1aca1c59fd0fc7b050d59a5c507af33beb599bec543b7b3c8186a7e7ece3c8aa47ef5383d115b06231e80bffc398598764fd642a7228e23bb1
-
SSDEEP
12288:nXJaAf3gv3zDtlZcqY18aAV0uyXVU62+eqvIwLT6Q11m14VELQrr+ZuHu/bf95Ro:5aO3gvjs8JV0uyXE1w/K6ELDuO/J5e
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.concaribe.com - Port:
21 - Username:
[email protected] - Password:
ro}UWgz#!38E
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Loads dropped DLL 1 IoCs
pid Process 3548 Documenti di spedizione 00039488580006996960.bat.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 33 api.ipify.org 34 api.ipify.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 2100 wabmig.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1648 powershell.exe 2100 wabmig.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1648 set thread context of 2100 1648 powershell.exe 91 -
pid Process 1648 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Documenti di spedizione 00039488580006996960.bat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wabmig.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1648 powershell.exe 1648 powershell.exe 1648 powershell.exe 1648 powershell.exe 1648 powershell.exe 1648 powershell.exe 1648 powershell.exe 1648 powershell.exe 1648 powershell.exe 2100 wabmig.exe 2100 wabmig.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1648 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1648 powershell.exe Token: SeDebugPrivilege 2100 wabmig.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3548 wrote to memory of 1648 3548 Documenti di spedizione 00039488580006996960.bat.exe 82 PID 3548 wrote to memory of 1648 3548 Documenti di spedizione 00039488580006996960.bat.exe 82 PID 3548 wrote to memory of 1648 3548 Documenti di spedizione 00039488580006996960.bat.exe 82 PID 1648 wrote to memory of 2100 1648 powershell.exe 91 PID 1648 wrote to memory of 2100 1648 powershell.exe 91 PID 1648 wrote to memory of 2100 1648 powershell.exe 91 PID 1648 wrote to memory of 2100 1648 powershell.exe 91 PID 1648 wrote to memory of 2100 1648 powershell.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\Documenti di spedizione 00039488580006996960.bat.exe"C:\Users\Admin\AppData\Local\Temp\Documenti di spedizione 00039488580006996960.bat.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle minimized "$Paleolith179=Get-Content 'C:\Users\Admin\AppData\Roaming\Fastlggende246\Ytringsfriheds.Boe';$Scob=$Paleolith179.SubString(55585,3);.$Scob($Paleolith179)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Program Files (x86)\windows mail\wabmig.exe"C:\Program Files (x86)\windows mail\wabmig.exe"3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
6KB
MD57f4a854abf13869f8b0f3c8952a1d4b0
SHA141c1dc531094abb81e5c37a04e7b88da14dd3980
SHA256971b9daea9ad21621ac81776c13fdd899979ab920fed44c9066a41f60b961a4c
SHA512df775a146adb801659bfec3921cf66975c8fa1425c66081ac168dc6294151d4a05c0c478d3d86fb445176bc7e775bd0165e8900d4354783ecdb9fab58a612dbe
-
Filesize
337KB
MD57a0107219f1b8581a5dfcd74dc9ef188
SHA10dfcf90e9fff6b02ea1b8fe83915f7b7fdb3a375
SHA256381a70fe5a97bb38740adbcbb16eb195c33993b32c5284fcd4f02aea48d90603
SHA51262fe1dc02212d68ab41c15d39e1ab784aab8fbb77930cd64a658e22bf9e784d29a5c192e31ba9f8f20d8bdfa4e3245795c4fc38d037651abfd35ccbc9e11ffdd
-
Filesize
54KB
MD546d49ead3b80676d7f7da4d9b4b12376
SHA191241d7dbfeca9f33276a879fe633c7961f94d8c
SHA256a2a21751e762e44cb4d9590c0eedc71f546bc9bf65c8bc4b7722021b1af16fa5
SHA512b62833aaa08aeba67bb17f911fa3f2876f254bc2f161ff61df3354b7ce165668cf2908f579350afd4c2c402a3910e0bf6269fe40d0c554688faa0a29a6b38400