Analysis
-
max time kernel
128s -
max time network
40s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
07-07-2020 18:24
Static task
static1
Behavioral task
behavioral1
Sample
Q0001DA.exe
Resource
win7
General
-
Target
Q0001DA.exe
-
Size
720KB
-
MD5
44e580df6cc98551d69220f7e3201684
-
SHA1
0544efea1c311e4fc93f95005aed42838d217b3a
-
SHA256
15de86087381df23faff003d4d1f7e5fb361ef730c28226405842fba3845af1f
-
SHA512
01ac5ea003900245507d15b20e430ff2f5b392de0db015fba150fa46e87b38d25c8feae0c688c8b642b692b1cd31b35e3fe6d6da73b0672087e586c0d6d56f6f
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
Mix2lower12?..
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1652-4-0x0000000000400000-0x00000000004A5000-memory.dmp family_agenttesla behavioral2/memory/1652-5-0x0000000002180000-0x00000000021CC000-memory.dmp family_agenttesla -
Processes:
resource yara_rule behavioral2/memory/1652-1-0x0000000000400000-0x00000000004A5000-memory.dmp upx behavioral2/memory/1652-3-0x0000000000400000-0x00000000004A5000-memory.dmp upx behavioral2/memory/1652-4-0x0000000000400000-0x00000000004A5000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Q0001DA.vbs notepad.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Q0001DA.exedescription pid process target process PID 1484 set thread context of 1652 1484 Q0001DA.exe Q0001DA.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Q0001DA.exeQ0001DA.exepid process 1484 Q0001DA.exe 1484 Q0001DA.exe 1652 Q0001DA.exe 1652 Q0001DA.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Q0001DA.exepid process 1484 Q0001DA.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Q0001DA.exedescription pid process Token: SeDebugPrivilege 1652 Q0001DA.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Q0001DA.exedescription pid process target process PID 1484 wrote to memory of 1592 1484 Q0001DA.exe notepad.exe PID 1484 wrote to memory of 1592 1484 Q0001DA.exe notepad.exe PID 1484 wrote to memory of 1592 1484 Q0001DA.exe notepad.exe PID 1484 wrote to memory of 1592 1484 Q0001DA.exe notepad.exe PID 1484 wrote to memory of 1592 1484 Q0001DA.exe notepad.exe PID 1484 wrote to memory of 1652 1484 Q0001DA.exe Q0001DA.exe PID 1484 wrote to memory of 1652 1484 Q0001DA.exe Q0001DA.exe PID 1484 wrote to memory of 1652 1484 Q0001DA.exe Q0001DA.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Q0001DA.exe"C:\Users\Admin\AppData\Local\Temp\Q0001DA.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\Q0001DA.exe"C:\Users\Admin\AppData\Local\Temp\Q0001DA.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1592-0-0x0000000000000000-mapping.dmp
-
memory/1652-2-0x00000000004A3260-mapping.dmp
-
memory/1652-1-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/1652-3-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/1652-4-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/1652-5-0x0000000002180000-0x00000000021CC000-memory.dmpFilesize
304KB
-
memory/1652-6-0x0000000002272000-0x0000000002273000-memory.dmpFilesize
4KB