Overview
overview
10Static
static
10Samples - ...24.zip
windows11-21h2-x64
1Samples - ...a1.exe
windows11-21h2-x64
10Samples - ...8b.exe
windows11-21h2-x64
10Samples - ...c2.dll
windows11-21h2-x64
1Samples - ...b5.exe
windows11-21h2-x64
10Samples - ...56.exe
windows11-21h2-x64
10Samples - ...57.exe
windows11-21h2-x64
1Samples - ...cb.exe
windows11-21h2-x64
10Samples - ...69.exe
windows11-21h2-x64
10Samples - ...0c.exe
windows11-21h2-x64
10Samples - ...9b.exe
windows11-21h2-x64
1Samples - ...64.exe
windows11-21h2-x64
1Samples - ...48.exe
windows11-21h2-x64
1Samples - ...d4.exe
windows11-21h2-x64
1Samples - ...3f.exe
windows11-21h2-x64
10Samples - ...dd.exe
windows11-21h2-x64
10Samples - ...3d.exe
windows11-21h2-x64
10Samples - ...fd.exe
windows11-21h2-x64
10Samples - ...a1.exe
windows11-21h2-x64
10Samples - ...cc.exe
windows11-21h2-x64
10Samples - ...51.exe
windows11-21h2-x64
10Samples - ...8b.exe
windows11-21h2-x64
10Samples - ...39.exe
windows11-21h2-x64
10Samples - ...d0.exe
windows11-21h2-x64
5Samples - ...75.exe
windows11-21h2-x64
3Samples - ...c7.exe
windows11-21h2-x64
5Samples - ...76.exe
windows11-21h2-x64
10Samples - ...bc.exe
windows11-21h2-x64
10Samples - ...b9.exe
windows11-21h2-x64
3Samples - ...f7.exe
windows11-21h2-x64
3Samples - ...2b.exe
windows11-21h2-x64
3Samples - ...22.exe
windows11-21h2-x64
10Resubmissions
10-10-2024 02:19
241010-crx4sazhnm 10Analysis
-
max time kernel
75s -
max time network
135s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
10-10-2024 02:19
Static task
static1
Behavioral task
behavioral1
Sample
Samples - 10-09-2024.zip
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
Samples - 10-09-2024/4311121804332b647e02280a9c551c85c16a46f24f2d2107a9bdceaa8923afa1.exe
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
Samples - 10-09-2024/44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b.exe
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
Samples - 10-09-2024/44f5ebb4facaba45274f08437a1f980bbbdb209cbd016ead76e4ec1afaca4dc2.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
Samples - 10-09-2024/4529554d09a020003227f1d879f6e202604c5875b89b9c3088a32c65211182b5.exe
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
Samples - 10-09-2024/45aae4515b7076d25923730c3672cb9e8f462cf402828fd3eb2d3255d626df56.exe
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
Samples - 10-09-2024/45b33888ddb2748434643e4811f156f1fc2a5d339d3577945d8c9e9d88c5ff57.exe
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
Samples - 10-09-2024/45ba5f7c168cfa2a68d8f8d448ee037d35fca5dbb7e9d4deb55f8e0ba97ceacb.exe
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
Samples - 10-09-2024/46173d25c61f353cb1c5047b6108cae5d4eb30bf24e9981dfc94f78b85f92c69.exe
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
Samples - 10-09-2024/462fafaa4badf6b5bba91bd555eb567db6be610a72d7efd8f039e9387924480c.exe
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
Samples - 10-09-2024/46936b0fef991d2d3ee9af2d07d2a90f0cc8260fa2ade9d661c197319798d89b.exe
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
Samples - 10-09-2024/47cf5e11cfe6184962783d4a21d7d35cd057ec8ca299c8c5fe69673a03fe5364.exe
Resource
win11-20241007-en
Behavioral task
behavioral13
Sample
Samples - 10-09-2024/49572fa3d9a71986235bda85410e9af9d4a6f087cc477e3813551a3789cdd148.exe
Resource
win11-20241007-en
Behavioral task
behavioral14
Sample
Samples - 10-09-2024/499d69d5ab8ba263975d5780e3b639a2a8905c50f2a1379bf972889c3913add4.exe
Resource
win11-20241007-en
Behavioral task
behavioral15
Sample
Samples - 10-09-2024/499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe
Resource
win11-20241007-en
Behavioral task
behavioral16
Sample
Samples - 10-09-2024/4a16685ec6d408bafc872fac39012bb670ff7bba818a7af9f7dd411a383869dd.exe
Resource
win11-20241007-en
Behavioral task
behavioral17
Sample
Samples - 10-09-2024/4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe
Resource
win11-20241007-en
Behavioral task
behavioral18
Sample
Samples - 10-09-2024/4acf2f8eeb71da00b6b5356b63c472157b7e0936f1f7b8f5a06aa295482319fd.exe
Resource
win11-20241007-en
Behavioral task
behavioral19
Sample
Samples - 10-09-2024/4ad7e405f5bcbfdf1cc163212428a779fa7d890a46500f579103333722986aa1.exe
Resource
win11-20241007-en
Behavioral task
behavioral20
Sample
Samples - 10-09-2024/4b6be11fd5704e5489c7911c1659f1bb7f9901e2d5c70c2f8f126512071093cc.exe
Resource
win11-20241007-en
Behavioral task
behavioral21
Sample
Samples - 10-09-2024/4ceb69afc05b1475459075f2cd5688f6aa8fe6a9ff6cae0a25d742b650c62351.exe
Resource
win11-20241007-en
Behavioral task
behavioral22
Sample
Samples - 10-09-2024/4d0b50e69d551bf15ec0a44c8471f8766ca5b98bd3b462c3bf0e976c76c1308b.exe
Resource
win11-20241007-en
Behavioral task
behavioral23
Sample
Samples - 10-09-2024/4e20a0aa3d323c0a1aa676c7eb3656cdd34cb69da614b4dc8aa946f5bcb2be39.exe
Resource
win11-20241007-en
Behavioral task
behavioral24
Sample
Samples - 10-09-2024/4e2c78a6bef2caef536cf00c467a54a7081adc8118e7741043e243c0eb4843d0.exe
Resource
win11-20241007-en
Behavioral task
behavioral25
Sample
Samples - 10-09-2024/4e3b746d859d34f64c28a2079f76f84d3c46b65907f52cb3da7d0ddd2c0dc875.exe
Resource
win11-20240802-en
Behavioral task
behavioral26
Sample
Samples - 10-09-2024/4eae876a9c21fadb647a6fe14c83272189ace267ebed4b320c73da14e095dec7.exe
Resource
win11-20241007-en
Behavioral task
behavioral27
Sample
Samples - 10-09-2024/4ed6d72fef68c583439e803871226e76588ce6436d10362011b21763e0ccf176.exe
Resource
win11-20241007-en
Behavioral task
behavioral28
Sample
Samples - 10-09-2024/4f43043ac4f71ee0f3416e75534ab2616ae90eb887a083b6f2e39995b334c2bc.exe
Resource
win11-20241007-en
Behavioral task
behavioral29
Sample
Samples - 10-09-2024/4f432ba1da38c64c9298fb2c2a0271c06dc333fb66e7f2b6deebf1ec6782c6b9.exe
Resource
win11-20241007-en
Behavioral task
behavioral30
Sample
Samples - 10-09-2024/4fa525bb40e57606312d30bcc45e697e6c92e9826e4ece20a5f74af64c22a5f7.exe
Resource
win11-20241007-en
Behavioral task
behavioral31
Sample
Samples - 10-09-2024/5030cfa10a9c06fbe2182aea828e449850e49c9f437c17e5bf8f7b634c48cd2b.exe
Resource
win11-20241007-en
Behavioral task
behavioral32
Sample
Samples - 10-09-2024/504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822.exe
Resource
win11-20241007-en
General
-
Target
Samples - 10-09-2024/499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe
-
Size
2.3MB
-
MD5
634121b2af66dd5433c1155702abc84c
-
SHA1
f3fd2a1800c4272bdf8209ff47e3703a4923e699
-
SHA256
499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f
-
SHA512
60786abdb281fe3f4fc4e242434fb280271684f13b683dc9cd32ac1a6e29ba496cea2c22ee1a82fa9dd6896f6530e9a0c07e2245ee35fc6100f7d684623bc805
-
SSDEEP
12288:tuEAmDY2kyLG/XModp1HmKwHfX7ZWezHiLfdHcWJWnVMaKo9Nip2IiUlbtgfXD70:cM9y3QvpHiLFcVVMaP9Nip7lbtgfT70
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.fosna.net - Port:
21 - Username:
[email protected] - Password:
u;4z3V.Iir1l
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Samples - 10-09-2024\499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe = "0" 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1584 powershell.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Samples - 10-09-2024\499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe = "0" 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 ip-api.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3400 set thread context of 2336 3400 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe 83 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jsc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1584 powershell.exe 1584 powershell.exe 2336 jsc.exe 2336 jsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1584 powershell.exe Token: SeDebugPrivilege 2336 jsc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3400 wrote to memory of 1584 3400 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe 81 PID 3400 wrote to memory of 1584 3400 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe 81 PID 3400 wrote to memory of 2336 3400 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe 83 PID 3400 wrote to memory of 2336 3400 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe 83 PID 3400 wrote to memory of 2336 3400 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe 83 PID 3400 wrote to memory of 2336 3400 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe 83 PID 3400 wrote to memory of 2336 3400 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe 83 PID 3400 wrote to memory of 2336 3400 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe 83 PID 3400 wrote to memory of 2336 3400 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe 83 PID 3400 wrote to memory of 2336 3400 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe 83 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Samples - 10-09-2024\499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe"C:\Users\Admin\AppData\Local\Temp\Samples - 10-09-2024\499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe"1⤵
- UAC bypass
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Windows security modification
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3400 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Samples - 10-09-2024\499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1584
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2336
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82