Overview
overview
10Static
static
3f97f261075...18.exe
windows7-x64
10f97f261075...18.exe
windows10-2004-x64
10$APPDATA/s...60.dll
windows7-x64
1$APPDATA/s...60.dll
windows10-2004-x64
1$APPDATA/s...er.dll
windows7-x64
1$APPDATA/s...er.dll
windows10-2004-x64
1$APPDATA/s...ui.dll
windows7-x64
1$APPDATA/s...ui.dll
windows10-2004-x64
1$APPDATA/s...ls.dll
windows7-x64
3$APPDATA/s...ls.dll
windows10-2004-x64
3$APPDATA/w...t2.exe
windows7-x64
$APPDATA/w...t2.exe
windows10-2004-x64
$APPDATA/w...ms.dll
windows7-x64
1$APPDATA/w...ms.dll
windows10-2004-x64
1$TEMP/Tenr...ar.dll
windows7-x64
10$TEMP/Tenr...ar.dll
windows10-2004-x64
10$TEMP/crm/...te.dll
windows7-x64
1$TEMP/crm/...te.dll
windows10-2004-x64
1$TEMP/crm/...dm.exe
windows7-x64
1$TEMP/crm/...dm.exe
windows10-2004-x64
1$TEMP/rede...UI.dll
windows7-x64
1$TEMP/rede...UI.dll
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
f97f261075ab2aa2bffa7e55db878dd9_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
f97f261075ab2aa2bffa7e55db878dd9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$APPDATA/scriptlibrary/39.opends60.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
$APPDATA/scriptlibrary/39.opends60.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$APPDATA/scriptlibrary/MCppCodeDomProvider.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
$APPDATA/scriptlibrary/MCppCodeDomProvider.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$APPDATA/scriptlibrary/autolaytui.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
$APPDATA/scriptlibrary/autolaytui.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$APPDATA/stow/gutils.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
$APPDATA/stow/gutils.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$APPDATA/with/count/ConmanClient2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
$APPDATA/with/count/ConmanClient2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$APPDATA/with/count/MicrosoftWindowsCEForms.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral14
Sample
$APPDATA/with/count/MicrosoftWindowsCEForms.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$TEMP/TenrecSaggar.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
$TEMP/TenrecSaggar.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$TEMP/crm/IEExecRemote.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral18
Sample
$TEMP/crm/IEExecRemote.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$TEMP/crm/StoreAdm.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
$TEMP/crm/StoreAdm.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$TEMP/redesign/pbo/ProjWizUI.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
$TEMP/redesign/pbo/ProjWizUI.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
$TEMP/TenrecSaggar.dll
-
Size
43KB
-
MD5
edb845779d91dcc37810eec0f029dfd3
-
SHA1
8ed5905bf015d0f7508b2af8b6be79a368aceada
-
SHA256
785275c1afb2a166f159c391a21afe5d82c30cc479a7837c28abb89adff67b87
-
SHA512
829b227037b4e3be5811b396ebaf7dbffb1ada24d955025d96f81a61d774c400b6c3997133f72cb1a601a7de60033baef344333bc8cd8749628eac4d206f2016
-
SSDEEP
768:JT0LUpldyjKuOexoIhIOGnTEDVBP3vydFd1sbUKV:JSCyhSgY4BidFiV
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.nusatek.com - Port:
587 - Username:
[email protected] - Password:
nusatek187753d - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 3 IoCs
resource yara_rule behavioral15/memory/532-6-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral15/memory/532-4-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral15/memory/532-3-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1816 rundll32.exe 1816 rundll32.exe 1816 rundll32.exe 1816 rundll32.exe 532 MSBuild.exe 532 MSBuild.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 1816 rundll32.exe 1816 rundll32.exe 1816 rundll32.exe 1816 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 532 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 532 MSBuild.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1816 1724 rundll32.exe 30 PID 1724 wrote to memory of 1816 1724 rundll32.exe 30 PID 1724 wrote to memory of 1816 1724 rundll32.exe 30 PID 1724 wrote to memory of 1816 1724 rundll32.exe 30 PID 1724 wrote to memory of 1816 1724 rundll32.exe 30 PID 1724 wrote to memory of 1816 1724 rundll32.exe 30 PID 1724 wrote to memory of 1816 1724 rundll32.exe 30 PID 1816 wrote to memory of 2240 1816 rundll32.exe 31 PID 1816 wrote to memory of 2240 1816 rundll32.exe 31 PID 1816 wrote to memory of 2240 1816 rundll32.exe 31 PID 1816 wrote to memory of 2240 1816 rundll32.exe 31 PID 1816 wrote to memory of 2240 1816 rundll32.exe 31 PID 1816 wrote to memory of 2240 1816 rundll32.exe 31 PID 1816 wrote to memory of 2240 1816 rundll32.exe 31 PID 1816 wrote to memory of 2240 1816 rundll32.exe 31 PID 1816 wrote to memory of 2240 1816 rundll32.exe 31 PID 1816 wrote to memory of 2240 1816 rundll32.exe 31 PID 1816 wrote to memory of 2176 1816 rundll32.exe 32 PID 1816 wrote to memory of 2176 1816 rundll32.exe 32 PID 1816 wrote to memory of 2176 1816 rundll32.exe 32 PID 1816 wrote to memory of 2176 1816 rundll32.exe 32 PID 1816 wrote to memory of 2176 1816 rundll32.exe 32 PID 1816 wrote to memory of 2176 1816 rundll32.exe 32 PID 1816 wrote to memory of 2176 1816 rundll32.exe 32 PID 1816 wrote to memory of 2176 1816 rundll32.exe 32 PID 1816 wrote to memory of 2176 1816 rundll32.exe 32 PID 1816 wrote to memory of 2176 1816 rundll32.exe 32 PID 1816 wrote to memory of 2304 1816 rundll32.exe 33 PID 1816 wrote to memory of 2304 1816 rundll32.exe 33 PID 1816 wrote to memory of 2304 1816 rundll32.exe 33 PID 1816 wrote to memory of 2304 1816 rundll32.exe 33 PID 1816 wrote to memory of 2304 1816 rundll32.exe 33 PID 1816 wrote to memory of 2304 1816 rundll32.exe 33 PID 1816 wrote to memory of 2304 1816 rundll32.exe 33 PID 1816 wrote to memory of 2304 1816 rundll32.exe 33 PID 1816 wrote to memory of 2304 1816 rundll32.exe 33 PID 1816 wrote to memory of 2304 1816 rundll32.exe 33 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 PID 1816 wrote to memory of 532 1816 rundll32.exe 34 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\TenrecSaggar.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\TenrecSaggar.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵PID:2240
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵PID:2176
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵PID:2304
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\gpupdate.exe""4⤵
- System Location Discovery: System Language Discovery
PID:2732
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\gpupdate.exe""4⤵
- System Location Discovery: System Language Discovery
PID:2680
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\gpupdate.exe""4⤵
- System Location Discovery: System Language Discovery
PID:2660
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\gpupdate.exe""4⤵
- System Location Discovery: System Language Discovery
PID:1532
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\gpupdate.exe""4⤵
- System Location Discovery: System Language Discovery
PID:2996
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\gpupdate.exe""4⤵
- System Location Discovery: System Language Discovery
PID:2988
-
-
-