Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    18-09-2024 09:49

General

  • Target

    ASW.exe

  • Size

    2.3MB

  • MD5

    634121b2af66dd5433c1155702abc84c

  • SHA1

    f3fd2a1800c4272bdf8209ff47e3703a4923e699

  • SHA256

    499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f

  • SHA512

    60786abdb281fe3f4fc4e242434fb280271684f13b683dc9cd32ac1a6e29ba496cea2c22ee1a82fa9dd6896f6530e9a0c07e2245ee35fc6100f7d684623bc805

  • SSDEEP

    12288:tuEAmDY2kyLG/XModp1HmKwHfX7ZWezHiLfdHcWJWnVMaKo9Nip2IiUlbtgfXD70:cM9y3QvpHiLFcVVMaP9Nip7lbtgfT70

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.fosna.net
  • Port:
    21
  • Username:
    fav@fosna.net
  • Password:
    u;4z3V.Iir1l

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • UAC bypass 3 TTPs 1 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ASW.exe
    "C:\Users\Admin\AppData\Local\Temp\ASW.exe"
    1⤵
    • UAC bypass
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1728
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ASW.exe" -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2420
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2704
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1728 -s 888
      2⤵
        PID:2820

    Network

    • flag-us
      DNS
      ip-api.com
      regsvcs.exe
      Remote address:
      8.8.8.8:53
      Request
      ip-api.com
      IN A
      Response
      ip-api.com
      IN A
      208.95.112.1
    • flag-us
      GET
      http://ip-api.com/line/?fields=hosting
      regsvcs.exe
      Remote address:
      208.95.112.1:80
      Request
      GET /line/?fields=hosting HTTP/1.1
      Host: ip-api.com
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Wed, 18 Sep 2024 09:49:13 GMT
      Content-Type: text/plain; charset=utf-8
      Content-Length: 6
      Access-Control-Allow-Origin: *
      X-Ttl: 60
      X-Rl: 44
    • 208.95.112.1:80
      http://ip-api.com/line/?fields=hosting
      http
      regsvcs.exe
      264 B
      307 B
      4
      3

      HTTP Request

      GET http://ip-api.com/line/?fields=hosting

      HTTP Response

      200
    • 8.8.8.8:53
      ip-api.com
      dns
      regsvcs.exe
      56 B
      72 B
      1
      1

      DNS Request

      ip-api.com

      DNS Response

      208.95.112.1

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1728-23-0x000007FEF57B3000-0x000007FEF57B4000-memory.dmp

      Filesize

      4KB

    • memory/1728-1-0x0000000000F40000-0x0000000000F58000-memory.dmp

      Filesize

      96KB

    • memory/1728-2-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

      Filesize

      9.9MB

    • memory/1728-3-0x000000001AC10000-0x000000001ACA4000-memory.dmp

      Filesize

      592KB

    • memory/1728-24-0x000007FEF57B0000-0x000007FEF619C000-memory.dmp

      Filesize

      9.9MB

    • memory/1728-0-0x000007FEF57B3000-0x000007FEF57B4000-memory.dmp

      Filesize

      4KB

    • memory/2420-8-0x00000000026F0000-0x0000000002770000-memory.dmp

      Filesize

      512KB

    • memory/2420-9-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

      Filesize

      2.9MB

    • memory/2420-10-0x00000000026E0000-0x00000000026E8000-memory.dmp

      Filesize

      32KB

    • memory/2704-20-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2704-17-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2704-15-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2704-13-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2704-11-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2704-21-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2704-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2704-22-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.