Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 896567" data-attributes="member: 32260">The initial malware (malware.exe) drops two files:&nbsp; &amp;startupname&amp;.exe (internal name BSCPQ.exe) and tmp1F0.tmp (XML script). It also adds the scheduled task to execute the script tmp1F0.tmp .&nbsp; This script executes &amp;startupname&amp;.exe (probably Agent Teslka malware).The malware.exe uses also the legal system file RegSvcs.exe which spawns Reg.exe (also legal) to make persistence via&nbsp; &quot;HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run&quot; and run the executable oPLNOE.exe from the user profile. The oPLNOE.exe is a copy of RegSvcs.exe.If I correctly remember the RegSvcs.exe is a target of shellcode injection in Agent Tesla malware.</blockquote>

[QUOTE="Andy Ful, post: 896567, member: 32260"] The initial malware ([B][COLOR=rgb(184, 49, 47)]malware.exe[/COLOR][/B]) drops two files: [COLOR=rgb(184, 49, 47)][B]&startupname&.exe[/B][/COLOR] (internal name BSCPQ.exe) and [COLOR=rgb(41, 105, 176)][B]tmp1F0.tmp[/B][/COLOR] (XML script). It also adds the scheduled task to execute the script [COLOR=rgb(41, 105, 176)][B]tmp1F0.tmp . [/B][/COLOR]This script executes [B][COLOR=rgb(184, 49, 47)]&startupname&.exe ([/COLOR][/B]probably Agent Teslka malware). The [B][COLOR=rgb(184, 49, 47)]malware.exe[/COLOR][/B] uses also the legal system file [COLOR=rgb(0, 168, 133)][B]RegSvcs.exe[/B][/COLOR] which spawns [B][COLOR=rgb(0, 168, 133)]Reg.exe[/COLOR][/B] (also legal) to make persistence via "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" and run the executable [COLOR=rgb(0, 168, 133)][B]oPLNOE.exe[/B][/COLOR] from the user profile. The [COLOR=rgb(0, 168, 133)][B]oPLNOE.exe[/B][/COLOR] is a copy of [B][COLOR=rgb(0, 168, 133)]RegSvcs.exe[/COLOR][/B]. If I correctly remember the RegSvcs.exe is a target of shellcode injection in Agent Tesla malware. [/QUOTE]

Verification