Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
07/07/2020, 08:39
Static task
static1
Behavioral task
behavioral1
Sample
Q0001DA.exe
Resource
win7
General
-
Target
Q0001DA.exe
-
Size
791KB
-
MD5
0cbe236bd971b3c66eae0105b9d1b963
-
SHA1
16a54302d3404dd169d90bb0b82922d6aabb35cd
-
SHA256
f6e1d512e3da60314732745faefb71123ec48154575d3b621546fc55e78e7a3c
-
SHA512
b4a72096a160530fbe629e0a800ebcad7ac7c479ce9774772e7d5847292e63d270f8cd26f8027dadf4ea593e96430a0380b181ea286939fd74d63c22d735a448
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
Mix2lower12?..
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
resource yara_rule behavioral2/memory/2228-2-0x00000000004A3260-mapping.dmp family_agenttesla behavioral2/memory/2228-4-0x0000000000400000-0x00000000004A5000-memory.dmp family_agenttesla behavioral2/memory/2228-5-0x0000000000990000-0x00000000009DC000-memory.dmp family_agenttesla -
resource yara_rule behavioral2/memory/2228-1-0x0000000000400000-0x00000000004A5000-memory.dmp upx behavioral2/memory/2228-3-0x0000000000400000-0x00000000004A5000-memory.dmp upx behavioral2/memory/2228-4-0x0000000000400000-0x00000000004A5000-memory.dmp upx -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Q0001DA.vbs notepad.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1740 set thread context of 2228 1740 Q0001DA.exe 69 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1740 Q0001DA.exe 1740 Q0001DA.exe 2228 Q0001DA.exe 2228 Q0001DA.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1740 Q0001DA.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2228 Q0001DA.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1740 wrote to memory of 3776 1740 Q0001DA.exe 68 PID 1740 wrote to memory of 3776 1740 Q0001DA.exe 68 PID 1740 wrote to memory of 3776 1740 Q0001DA.exe 68 PID 1740 wrote to memory of 3776 1740 Q0001DA.exe 68 PID 1740 wrote to memory of 3776 1740 Q0001DA.exe 68 PID 1740 wrote to memory of 2228 1740 Q0001DA.exe 69 PID 1740 wrote to memory of 2228 1740 Q0001DA.exe 69 PID 1740 wrote to memory of 2228 1740 Q0001DA.exe 69
Processes
-
C:\Users\Admin\AppData\Local\Temp\Q0001DA.exe"C:\Users\Admin\AppData\Local\Temp\Q0001DA.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
PID:3776
-
-
C:\Users\Admin\AppData\Local\Temp\Q0001DA.exe"C:\Users\Admin\AppData\Local\Temp\Q0001DA.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2228
-