Analysis
-
max time kernel
145s -
max time network
84s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
07-07-2020 12:41
Static task
static1
Behavioral task
behavioral1
Sample
PO JMC.exe
Resource
win7
Behavioral task
behavioral2
Sample
PO JMC.exe
Resource
win10v200430
General
-
Target
PO JMC.exe
-
Size
536KB
-
MD5
2f789773ba1a14aaeed41351f1f847b7
-
SHA1
4fa7a4108a7dab7bca7155e27f1e37b755471d56
-
SHA256
19d1dc119b0f98dd6151eb72ef1f8934b117238fb99bde97ba808d8888618310
-
SHA512
ffdf7b1222d8b9f91ca1a83dcb84653c690aa4fb26bea1b70ead8341b36d50ed42022679602617f817f6f23110acb426798302693b6bfd58f8dd1c101fe0ba2d
Malware Config
Extracted
Protocol: ftp- Host:
ftp.ciftci.com.tr - Port:
21 - Username:
[email protected] - Password:
Wefullground2#
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO JMC.exedescription pid process target process PID 3544 set thread context of 2132 3544 PO JMC.exe PO JMC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PO JMC.exedescription pid process Token: SeDebugPrivilege 2132 PO JMC.exe -
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
PO JMC.exedescription pid process target process PID 3544 wrote to memory of 2132 3544 PO JMC.exe PO JMC.exe PID 3544 wrote to memory of 2132 3544 PO JMC.exe PO JMC.exe PID 3544 wrote to memory of 2132 3544 PO JMC.exe PO JMC.exe PID 3544 wrote to memory of 2132 3544 PO JMC.exe PO JMC.exe PID 3544 wrote to memory of 2132 3544 PO JMC.exe PO JMC.exe PID 3544 wrote to memory of 2132 3544 PO JMC.exe PO JMC.exe PID 3544 wrote to memory of 2132 3544 PO JMC.exe PO JMC.exe PID 3544 wrote to memory of 2132 3544 PO JMC.exe PO JMC.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
PO JMC.exepid process 2132 PO JMC.exe 2132 PO JMC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PO JMC.exepid process 2132 PO JMC.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO JMC.exe"C:\Users\Admin\AppData\Local\Temp\PO JMC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO JMC.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx