Analysis
-
max time kernel
94s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-09-2024 20:58
Behavioral task
behavioral1
Sample
bashoo.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bashoo.exe
Resource
win10v2004-20240802-en
General
-
Target
bashoo.exe
-
Size
35KB
-
MD5
2db9421577d39c8fdeaab542ee35f483
-
SHA1
346d5db7df5cdbb843e9df60724a55e70a51c018
-
SHA256
9329ac7ceda44f47a90f67ef1e12add90fddb97bbf1be96a6e3e6f66a7002187
-
SHA512
7931796900ba0573733d240d5252d15a4957b1c6251ea359fcfb1c8ef11607948210c2484356b831659158d575c0f848a0b6886b6e177a83370b9c6d0c842969
-
SSDEEP
384:XZirz04kYcm5oRVPUn30CDG1iZMJSalHXeqZhsWIgDWsjxZUtO4f54A:Mi+5uVPUn30gGEZQH5SAXJ4f54A
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation bashoo.exe -
Executes dropped EXE 1 IoCs
pid Process 2928 system.exe -
resource yara_rule behavioral2/memory/3116-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000023477-7.dat upx behavioral2/memory/2928-14-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3116-15-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2928-18-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MyApp = "C:\\WINDOWS\\system.exe" bashoo.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\WINDOWS\system.exe bashoo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bashoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3116 bashoo.exe 2928 system.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3116 wrote to memory of 2928 3116 bashoo.exe 82 PID 3116 wrote to memory of 2928 3116 bashoo.exe 82 PID 3116 wrote to memory of 2928 3116 bashoo.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\bashoo.exe"C:\Users\Admin\AppData\Local\Temp\bashoo.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\WINDOWS\system.exe"C:\WINDOWS\system.exe" 02⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD59e64056a609af6f66db76d1dc17e0675
SHA132e900856a8366a4d579b53f00a95edc45637116
SHA256be945fbfb6a5045a730d35e288cb049e2040cbc8c871a6aebca8bf65672e7a41
SHA5125a3aa6470df3bcf3cb337505d78240d62d14c551ec3b31d85a655f1dfd18cb9de917f442ce39fe39eacee7442a950a760fbe31fd51700eb26c7726549c4503c1