Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    23-09-2024 10:06

General

  • Target

    PI #OVES1912196.scr.exe

  • Size

    826KB

  • MD5

    1b136a73f10f2b2b837c46161eceaba9

  • SHA1

    0bb6bfbd1a79432f03e1b51f697f664a628a5e90

  • SHA256

    7df1b33f35a3ca87f9242153c847cc0d8e1d45c7e3b5c5ecf9f23bddbf94b052

  • SHA512

    30a82ab4146edf04179f53dc0527baf9b7bb8c82288009cb6704c47ba1c735ca96a57206a739d209b7ed3615ae52847d2f4a0ec8b1e889d06b323051ee344e30

  • SSDEEP

    24576:wiHxlaIGgVnElx5T6GMgitt8p10uF2VtQ/2:wiHxlaHl/6GtitGf0uF2VtQ/2

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PI #OVES1912196.scr.exe
    "C:\Users\Admin\AppData\Local\Temp\PI #OVES1912196.scr.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PI #OVES1912196.scr.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2896
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OKOdVL.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2704
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OKOdVL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAFDF.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2764
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:480

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpAFDF.tmp

    Filesize

    1KB

    MD5

    e28ab7c7bdec48dbf4ac7f20c7f6ea21

    SHA1

    052940f5dd1af4edecdf5a2e254b90cfa46ac81f

    SHA256

    5eb2454e0e865d57c746255424e08faa6c8dcaf1286e0c9c7acf4a3cfdfdeb0e

    SHA512

    4f5d35a9b15d0cbb7ee595fd8e780a624170283cefe3327c1c2cbf9efeeffe827c584068892c458f9178c75f5461ce87bd9956c6eb578d128dcb1712851a37a3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    9410e43d5897ddc096fbe155c3642871

    SHA1

    e94184c1cd9862b6b9a801acfd0a327022a55923

    SHA256

    c5a5b99723bc6e927e61a78be65c57330e93e3a30ef77646efe74a07f6a46ad3

    SHA512

    7a81cab962292d2d6bbf081a54d4b7d236fe51656de8aac500ca11331b10d23805f0f0b7cf7d0122e24d0bf38b63601bfc241b24d9bbea8683bfd457c583ea3e

  • memory/480-28-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/480-31-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/480-21-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/480-23-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/480-25-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/480-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/480-29-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/480-19-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/2736-6-0x00000000051F0000-0x0000000005272000-memory.dmp

    Filesize

    520KB

  • memory/2736-1-0x00000000011B0000-0x0000000001284000-memory.dmp

    Filesize

    848KB

  • memory/2736-0-0x0000000074C3E000-0x0000000074C3F000-memory.dmp

    Filesize

    4KB

  • memory/2736-2-0x0000000074C30000-0x000000007531E000-memory.dmp

    Filesize

    6.9MB

  • memory/2736-3-0x00000000004B0000-0x00000000004C2000-memory.dmp

    Filesize

    72KB

  • memory/2736-5-0x0000000074C30000-0x000000007531E000-memory.dmp

    Filesize

    6.9MB

  • memory/2736-4-0x0000000074C3E000-0x0000000074C3F000-memory.dmp

    Filesize

    4KB

  • memory/2736-32-0x0000000074C30000-0x000000007531E000-memory.dmp

    Filesize

    6.9MB