Overview
overview
10Static
static
3f97f261075...18.exe
windows7-x64
10f97f261075...18.exe
windows10-2004-x64
10$APPDATA/s...60.dll
windows7-x64
1$APPDATA/s...60.dll
windows10-2004-x64
1$APPDATA/s...er.dll
windows7-x64
1$APPDATA/s...er.dll
windows10-2004-x64
1$APPDATA/s...ui.dll
windows7-x64
1$APPDATA/s...ui.dll
windows10-2004-x64
1$APPDATA/s...ls.dll
windows7-x64
3$APPDATA/s...ls.dll
windows10-2004-x64
3$APPDATA/w...t2.exe
windows7-x64
$APPDATA/w...t2.exe
windows10-2004-x64
$APPDATA/w...ms.dll
windows7-x64
1$APPDATA/w...ms.dll
windows10-2004-x64
1$TEMP/Tenr...ar.dll
windows7-x64
10$TEMP/Tenr...ar.dll
windows10-2004-x64
10$TEMP/crm/...te.dll
windows7-x64
1$TEMP/crm/...te.dll
windows10-2004-x64
1$TEMP/crm/...dm.exe
windows7-x64
1$TEMP/crm/...dm.exe
windows10-2004-x64
1$TEMP/rede...UI.dll
windows7-x64
1$TEMP/rede...UI.dll
windows10-2004-x64
1Analysis
-
max time kernel
97s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
f97f261075ab2aa2bffa7e55db878dd9_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
f97f261075ab2aa2bffa7e55db878dd9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$APPDATA/scriptlibrary/39.opends60.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
$APPDATA/scriptlibrary/39.opends60.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$APPDATA/scriptlibrary/MCppCodeDomProvider.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
$APPDATA/scriptlibrary/MCppCodeDomProvider.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$APPDATA/scriptlibrary/autolaytui.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
$APPDATA/scriptlibrary/autolaytui.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$APPDATA/stow/gutils.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
$APPDATA/stow/gutils.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$APPDATA/with/count/ConmanClient2.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
$APPDATA/with/count/ConmanClient2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$APPDATA/with/count/MicrosoftWindowsCEForms.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral14
Sample
$APPDATA/with/count/MicrosoftWindowsCEForms.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$TEMP/TenrecSaggar.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
$TEMP/TenrecSaggar.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$TEMP/crm/IEExecRemote.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral18
Sample
$TEMP/crm/IEExecRemote.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$TEMP/crm/StoreAdm.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
$TEMP/crm/StoreAdm.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$TEMP/redesign/pbo/ProjWizUI.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
$TEMP/redesign/pbo/ProjWizUI.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
$TEMP/TenrecSaggar.dll
-
Size
43KB
-
MD5
edb845779d91dcc37810eec0f029dfd3
-
SHA1
8ed5905bf015d0f7508b2af8b6be79a368aceada
-
SHA256
785275c1afb2a166f159c391a21afe5d82c30cc479a7837c28abb89adff67b87
-
SHA512
829b227037b4e3be5811b396ebaf7dbffb1ada24d955025d96f81a61d774c400b6c3997133f72cb1a601a7de60033baef344333bc8cd8749628eac4d206f2016
-
SSDEEP
768:JT0LUpldyjKuOexoIhIOGnTEDVBP3vydFd1sbUKV:JSCyhSgY4BidFiV
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.nusatek.com - Port:
587 - Username:
[email protected] - Password:
nusatek187753d - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
resource yara_rule behavioral16/memory/4100-5-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 5048 rundll32.exe 4100 MSBuild.exe 4100 MSBuild.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5048 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4100 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4100 MSBuild.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3964 wrote to memory of 5048 3964 rundll32.exe 82 PID 3964 wrote to memory of 5048 3964 rundll32.exe 82 PID 3964 wrote to memory of 5048 3964 rundll32.exe 82 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 PID 5048 wrote to memory of 4100 5048 rundll32.exe 83 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\TenrecSaggar.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\TenrecSaggar.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:4100
-
-