Analysis
-
max time kernel
111s -
max time network
117s -
platform
windows7_x64 -
resource
win7 -
submitted
08-07-2020 08:22
Static task
static1
Behavioral task
behavioral1
Sample
Late Review Order Project.exe
Resource
win7
Behavioral task
behavioral2
Sample
Late Review Order Project.exe
Resource
win10
General
-
Target
Late Review Order Project.exe
-
Size
891KB
-
MD5
e4b3a7f5c5173c5ca72f3a5d5bc2d4d6
-
SHA1
eb698b2a8c911122cfc4cd152fa5c079df40d36d
-
SHA256
36418297fd0a5c6118bd0838825b7d54a9e144fea29428a48eea7c4ed5cb7499
-
SHA512
7fcc3d4c9e77745ae74743ce46407aa37e4dcaa2c871a9a772b6f89abc1f0b9a68345051bfd399f86c787a55337fa32ce27c9c3b72e40d921aed923a7c55be2f
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Late Review Order Project.exepid process 900 Late Review Order Project.exe 900 Late Review Order Project.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Late Review Order Project.exedescription pid process Token: SeDebugPrivilege 900 Late Review Order Project.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/900-1-0x0000000000000000-0x0000000000000000-disk.dmp