Analysis
-
max time kernel
138s -
max time network
74s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
07-07-2020 09:22
Static task
static1
Behavioral task
behavioral1
Sample
Transfer Advice.exe
Resource
win7
Behavioral task
behavioral2
Sample
Transfer Advice.exe
Resource
win10v200430
General
-
Target
Transfer Advice.exe
-
Size
605KB
-
MD5
8180638266f9813bbec4767f7c089f25
-
SHA1
6aefd511fba76f218a3f9e27c5153d59d7571e48
-
SHA256
b069fefb0a7ec5da3848f424fa73282b4eba86101c22bcfa3f4a865057ba3d1d
-
SHA512
87b860a116c1524e689e63f2d30d39c531df317edcde0e92f1356d25a2d342f2e3774dfc1b5f273221f51716eb3d5f77773acdd7053eb1c405f499a0317ce478
Malware Config
Extracted
Protocol: ftp- Host:
ftp.ciftci.com.tr - Port:
21 - Username:
[email protected] - Password:
Idonhammer2#
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Transfer Advice.exedescription pid process target process PID 3656 wrote to memory of 2220 3656 Transfer Advice.exe Transfer Advice.exe PID 3656 wrote to memory of 2220 3656 Transfer Advice.exe Transfer Advice.exe PID 3656 wrote to memory of 2220 3656 Transfer Advice.exe Transfer Advice.exe PID 3656 wrote to memory of 2220 3656 Transfer Advice.exe Transfer Advice.exe PID 3656 wrote to memory of 2220 3656 Transfer Advice.exe Transfer Advice.exe PID 3656 wrote to memory of 2220 3656 Transfer Advice.exe Transfer Advice.exe PID 3656 wrote to memory of 2220 3656 Transfer Advice.exe Transfer Advice.exe PID 3656 wrote to memory of 2220 3656 Transfer Advice.exe Transfer Advice.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Transfer Advice.exedescription pid process target process PID 3656 set thread context of 2220 3656 Transfer Advice.exe Transfer Advice.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Transfer Advice.exedescription pid process Token: SeDebugPrivilege 2220 Transfer Advice.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Transfer Advice.exepid process 2220 Transfer Advice.exe 2220 Transfer Advice.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Transfer Advice.exepid process 2220 Transfer Advice.exe -
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Transfer Advice.exe"C:\Users\Admin\AppData\Local\Temp\Transfer Advice.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Transfer Advice.exe"C:\Users\Admin\AppData\Local\Temp\Transfer Advice.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx