Overview

overview

10

Static

static

1

PO#2500008...Xls.js

windows7-x64

10

PO#2500008...Xls.js

windows10-2004-x64

10

Analysis

  • max time kernel
    297s
  • max time network
    299s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2025, 00:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PO#2500008_ Jan_2025.Xls.js
  • Size 955KB
  • Sample250107-aab4watpgz
  • SHA256 b7e9e72922bbafab57989a81d72e1dee75ae384bd975cce8a707417cc1df725a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agentteslastrratwshratcollectiondiscoveryexecutionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Credentials
  • Protocol

    smtp
  • Host

    smtp.gmail.com
  • Port

    587
  • Username

    [email protected]
  • Password

    bizr usjt guapiims

Extracted

Family

  • strrat

C2

  • chongmei33.publicvm.com:44662

  • chongmei33.myddns.rocks:44662

Attributes
  • license_id

    khonsari

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    true

  • secondary_startup

    true

  • startup

    true

Extracted

Family

  • agenttesla

Credentials

Extracted

Family

  • wshrat

C2

  • http://chongmei33.myddns.rocks:7044

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Agenttesla family
    agenttesla
  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

    trojanstealerstrrat
  • Strrat family
    strrat
  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat
  • Wshrat family
    wshrat
  • Blocklisted process makes network request 44 IoCs
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 7 IoCs
    collection
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Script User-Agent 44 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO#2500008_ Jan_2025.Xls.js"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5076
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\adobe.js"
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Program Files\Java\jre-1.8\bin\javaw.exe
        "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\TZQ.jar"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3024
        • C:\Program Files\Java\jre-1.8\bin\java.exe
          "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\TZQ.jar"
          4⤵
          • Drops startup file
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3540
          • C:\Windows\SYSTEM32\cmd.exe
            cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\TZQ.jar"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3116
            • C:\Windows\system32\schtasks.exe
              schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\TZQ.jar"
              6⤵
              • Scheduled Task/Job: Scheduled Task
              PID:1016
          • C:\Program Files\Java\jre-1.8\bin\java.exe
            "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\TZQ.jar"
            5⤵
            • Loads dropped DLL
            • Accesses Microsoft Outlook profiles
            • Suspicious use of WriteProcessMemory
            • outlook_office_path
            • outlook_win_path
            PID:1440
            • C:\Windows\SYSTEM32\cmd.exe
              cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3724
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
                7⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3816
            • C:\Windows\SYSTEM32\cmd.exe
              cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1704
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
                7⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3364
            • C:\Windows\SYSTEM32\cmd.exe
              cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1544
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
                7⤵
                  PID:3432
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:940
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list
                  7⤵
                    PID:1964
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe "[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime] $vault = New-Object Windows.Security.Credentials.PasswordVault $vault.RetrieveAll() | % { $_.RetrievePassword();$_ }"
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1916
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\word.js"
          2⤵
          • Checks computer location settings
          • Drops startup file
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3352
          • C:\Windows\System32\wscript.exe
            "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\word.js"
            3⤵
            • Blocklisted process makes network request
            • Checks computer location settings
            • Drops startup file
            • Adds Run key to start application
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:5092
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\ADOBE.js"
              4⤵
              • Checks computer location settings
              • Suspicious use of WriteProcessMemory
              PID:3996
              • C:\Users\Admin\AppData\Local\Temp\hAgO.exe
                "C:\Users\Admin\AppData\Local\Temp\hAgO.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:1832

      Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            JavaScript

            1
            T1059.007

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Modify Registry

            1
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            2
            T1552

            Credentials In Files

            2
            T1552.001

            Discovery

            Query Registry

            2
            T1012

            System Information Discovery

            2
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Data from Local System

            2
            T1005

            Email Collection

            1
            T1114

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            3903daac9bc4a3b7.timestamp
            • Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
            • Size 46B
            • SHA256 8cc196987969d9a6ebd2fec9ae5592175dd155ee66a0cc291b4fcbe7c774871e
            • MD5 SHA1 SHA512
            Submit Download

            TZQ.jar
            • Path C:\Users\Admin\AppData\Local\Temp\TZQ.jar
            • Size 265KB
            • SHA256 db396f9ae63eab45892eed0964926126301abaec49d356765b8cd181572551e5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            __PSScriptPolicyTest_d1mui34q.kng.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d1mui34q.kng.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512
            Submit Download

            adobe.js
            • Path C:\Users\Admin\AppData\Local\Temp\adobe.js
            • Size 376KB
            • SHA256 6db12be58fe93da654afb1f98737e2e1fa05be9c3acce26413792cf30f9e482e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            hAgO.exe
            • Path C:\Users\Admin\AppData\Local\Temp\hAgO.exe
            • Size 243KB
            • SHA256 1f19267129cbabe2e50837f88eb2854c64521bd964f43a58f37365e60d5da5bd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jna7710216679996053643.dll
            • Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna7710216679996053643.dll
            • Size 241KB
            • SHA256 a66959bec2ef5af730198db9f3b3f7cab0d4ae70ce01bec02bf1d738e6d1ee7a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            sqlite-3.14.2.1-54d33411-99b7-428c-aeff-01f75a9eda32-sqlitejdbc.dll
            • Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.14.2.1-54d33411-99b7-428c-aeff-01f75a9eda32-sqlitejdbc.dll
            • Size 914KB
            • SHA256 05a8557f5d197aca468f5272a2a869293cb11c2f0ab4839a17f144f9a5d0b77d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            word.js
            • Path C:\Users\Admin\AppData\Local\Temp\word.js
            • Size 305KB
            • SHA256 7693d4d8b365e1e7592dab1df24c67c133d0327a82cfab4f806f894b713b7847
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ADOBE.js
            • Path C:\Users\Admin\AppData\Roaming\ADOBE.js
            • Size 2.9MB
            • SHA256 7f8e20b0f1db9bfca5af1baca595e3989fa2ea5b8a1663edd8d2065737ee3778
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            83aa4cc77f591dfc2374580bbd95f6ba_dc5cddf5-9e4b-4c89-ba53-89649a7a5ee7
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4089630652-1596403869-279772308-1000\83aa4cc77f591dfc2374580bbd95f6ba_dc5cddf5-9e4b-4c89-ba53-89649a7a5ee7
            • Size 45B
            • SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
            • MD5 SHA1 SHA512
            Submit Download

            word.js
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\word.js
            • Size 305KB
            • SHA256 56d134bbb1d29dceec71cbec8de83bb2ce5341b6c8a1e29373d85c7243af688f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jna-5.5.0.jar
            • Path C:\Users\Admin\lib\jna-5.5.0.jar
            • Size 1.4MB
            • SHA256 b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jna-platform-5.5.0.jar
            • Path C:\Users\Admin\lib\jna-platform-5.5.0.jar
            • Size 2.6MB
            • SHA256 24d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            sqlite-jdbc-3.14.2.1.jar
            • Path C:\Users\Admin\lib\sqlite-jdbc-3.14.2.1.jar
            • Size 4.1MB
            • SHA256 2eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            system-hook-3.5.jar
            • Path C:\Users\Admin\lib\system-hook-3.5.jar
            • Size 772KB
            • SHA256 2ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/1440-268-0x0000000061680000-0x000000006176D000-memory.dmp
            Download

            memory/1440-163-0x000001F617970000-0x000001F617971000-memory.dmp
            Download

            memory/1832-235-0x0000000006050000-0x00000000060EC000-memory.dmp
            Download

            memory/1832-234-0x0000000005F60000-0x0000000005FB0000-memory.dmp
            Download

            memory/1832-238-0x00000000067C0000-0x00000000067CA000-memory.dmp
            Download

            memory/1832-231-0x0000000000750000-0x0000000000794000-memory.dmp
            Download

            memory/1832-232-0x0000000005760000-0x0000000005D04000-memory.dmp
            Download

            memory/1832-233-0x00000000051B0000-0x0000000005216000-memory.dmp
            Download

            memory/1832-237-0x0000000006620000-0x00000000066B2000-memory.dmp
            Download

            memory/1916-250-0x000001A07E1F0000-0x000001A07E1F8000-memory.dmp
            Download

            memory/1916-241-0x000001A07E210000-0x000001A07E232000-memory.dmp
            Download

            memory/1916-249-0x000001A07E1E0000-0x000001A07E1EA000-memory.dmp
            Download

            memory/3024-70-0x000002119F200000-0x000002119F201000-memory.dmp
            Download

            memory/3024-73-0x000002119F200000-0x000002119F201000-memory.dmp
            Download

            memory/3024-56-0x000002119F200000-0x000002119F201000-memory.dmp
            Download

            memory/3024-77-0x000002119F200000-0x000002119F201000-memory.dmp
            Download

            memory/3024-90-0x000002119F200000-0x000002119F201000-memory.dmp
            Download

            memory/3024-96-0x000002119F200000-0x000002119F201000-memory.dmp
            Download

            memory/3024-54-0x000002119F200000-0x000002119F201000-memory.dmp
            Download

            memory/3024-36-0x000002119F200000-0x000002119F201000-memory.dmp
            Download

            memory/3540-130-0x000001A6DC800000-0x000001A6DC801000-memory.dmp
            Download