Analysis
-
max time kernel
123s -
max time network
112s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
30-06-2020 12:21
Static task
static1
Behavioral task
behavioral1
Sample
Doc#243567298.exe
Resource
win7
Behavioral task
behavioral2
Sample
Doc#243567298.exe
Resource
win10v200430
General
-
Target
Doc#243567298.exe
-
Size
574KB
-
MD5
2181ddc7631f71f3d6809ba15f89bf49
-
SHA1
cd660cf95580790d1021d69d3e11423586938c32
-
SHA256
bce54c823dd88b4bcb06eac2581ba7c290476786d6c76daf0f765066742e0c6f
-
SHA512
382213d0b5d584c5db7a941c0b4b9cc1e6e9fffc017d6c8feaff33f6e3d0114d490c33cbca3d5a6193a2b70ee30c5a7c7f5e6e7556cb89cf69fb2c18338b0cfd
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
dogdollars@jakartta.xyz - Password:
winnerq123
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2888-2-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral2/memory/2888-3-0x0000000000446A1E-mapping.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Doc#243567298.exedescription pid process target process PID 2564 set thread context of 2888 2564 Doc#243567298.exe Doc#243567298.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Doc#243567298.exepid process 2888 Doc#243567298.exe 2888 Doc#243567298.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Doc#243567298.exedescription pid process Token: SeDebugPrivilege 2888 Doc#243567298.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Doc#243567298.exepid process 2888 Doc#243567298.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Doc#243567298.exedescription pid process target process PID 2564 wrote to memory of 2316 2564 Doc#243567298.exe schtasks.exe PID 2564 wrote to memory of 2316 2564 Doc#243567298.exe schtasks.exe PID 2564 wrote to memory of 2316 2564 Doc#243567298.exe schtasks.exe PID 2564 wrote to memory of 2888 2564 Doc#243567298.exe Doc#243567298.exe PID 2564 wrote to memory of 2888 2564 Doc#243567298.exe Doc#243567298.exe PID 2564 wrote to memory of 2888 2564 Doc#243567298.exe Doc#243567298.exe PID 2564 wrote to memory of 2888 2564 Doc#243567298.exe Doc#243567298.exe PID 2564 wrote to memory of 2888 2564 Doc#243567298.exe Doc#243567298.exe PID 2564 wrote to memory of 2888 2564 Doc#243567298.exe Doc#243567298.exe PID 2564 wrote to memory of 2888 2564 Doc#243567298.exe Doc#243567298.exe PID 2564 wrote to memory of 2888 2564 Doc#243567298.exe Doc#243567298.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Doc#243567298.exe"C:\Users\Admin\AppData\Local\Temp\Doc#243567298.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EaRAbigWAwa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7A66.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Doc#243567298.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Doc#243567298.exe.logMD5
3753b01eddc20f64178eaf3d55b5c146
SHA1ca50665940eb8519e1df0c1f185fb72a271c2a66
SHA25699096651b1d9b4a7562f56c8e42c06d1166f7f22a93816e2862317ada8154b37
SHA512566366e651e94fab25454fb0199508cd62a64723137b32fbd5bee531110403d9194b9a4fc053740c571a69e820c1c72e48d65fc3a5410a22b6ae9d2e55508bf3
-
C:\Users\Admin\AppData\Local\Temp\tmp7A66.tmpMD5
4d1c1742080b05d0fdc29542686a3765
SHA16d88f45506db54d7cb8b47464288d40ba13fe0ba
SHA2561a75c2f146a56376d3c830ba4e8dbb05c58b219d894f1613121c33ae83f7c021
SHA512aebf3135137a1988999b2676cf50a868fbdf46428567311a2d1f5739d766f769c54ed062a056e7d2069807ef2e3219f066e108152751c0ed6d70e78f16f5acdf
-
memory/2316-0-0x0000000000000000-mapping.dmp
-
memory/2888-2-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2888-3-0x0000000000446A1E-mapping.dmp