Analysis
-
max time kernel
137s -
max time network
84s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
08-07-2020 05:21
Static task
static1
Behavioral task
behavioral1
Sample
Price Offer.exe
Resource
win7
Behavioral task
behavioral2
Sample
Price Offer.exe
Resource
win10v200430
General
-
Target
Price Offer.exe
-
Size
829KB
-
MD5
4a65df90cfbbbe0130de931d25eb8433
-
SHA1
034b403f9049f81c8177092f5ef30c2a2b2b7c64
-
SHA256
9dda846870b687794890a95e4532f7886dcf61d6bfcd4cbc2ddeb306abc22311
-
SHA512
c0e1a667655fffb319367276558d160b668cd663551414815ec009b01b8cd090bf75376f11a2fe547aefd5d58656ebc00c5980405958d037a900be30e9c13f69
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.chenklins.com - Port:
587 - Username:
[email protected] - Password:
VBRSv_r)C~mM
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3832-2-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral2/memory/3832-3-0x0000000000446DCE-mapping.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Price Offer.exedescription pid process target process PID 640 set thread context of 3832 640 Price Offer.exe Price Offer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Price Offer.exepid process 3832 Price Offer.exe 3832 Price Offer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Price Offer.exedescription pid process Token: SeDebugPrivilege 3832 Price Offer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Price Offer.exepid process 3832 Price Offer.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Price Offer.exedescription pid process target process PID 640 wrote to memory of 2724 640 Price Offer.exe schtasks.exe PID 640 wrote to memory of 2724 640 Price Offer.exe schtasks.exe PID 640 wrote to memory of 2724 640 Price Offer.exe schtasks.exe PID 640 wrote to memory of 3832 640 Price Offer.exe Price Offer.exe PID 640 wrote to memory of 3832 640 Price Offer.exe Price Offer.exe PID 640 wrote to memory of 3832 640 Price Offer.exe Price Offer.exe PID 640 wrote to memory of 3832 640 Price Offer.exe Price Offer.exe PID 640 wrote to memory of 3832 640 Price Offer.exe Price Offer.exe PID 640 wrote to memory of 3832 640 Price Offer.exe Price Offer.exe PID 640 wrote to memory of 3832 640 Price Offer.exe Price Offer.exe PID 640 wrote to memory of 3832 640 Price Offer.exe Price Offer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Price Offer.exe"C:\Users\Admin\AppData\Local\Temp\Price Offer.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tkNWvXCEaFXDX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4F4F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Price Offer.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Price Offer.exe.logMD5
ef140ef600b2463c9e7dbf064a104046
SHA1c08fd1853877be95575ea2e860dd8cafef31f54c
SHA256ad8ae97fdeb174b20f02c7ddf9466981856d77d51133599b5954f48f78a1b616
SHA512bf16df0994080bdc832cb39a312e0095de57608256fcf0d04d589e0bdf3283f918fb0d6ec86ea28a4b1af6db12813c52a724028f02330ebc3a9d32a4fcda706c
-
C:\Users\Admin\AppData\Local\Temp\tmp4F4F.tmpMD5
dc39bc41a6bf2bb7099ce9825ba9f4f0
SHA13425c3ed48532c341545c8ff2bdc1a4e32fbccf2
SHA256073ec5abcbf6e5f3f99cb53ae97d971fd551c5d24e47461848d2b2aedd0dd074
SHA512864dab80a58a16bf3f4e49997393920a535f98d9eb4224884034d37681505b3e11fedcffa58225a80ef5d5f0e55b55779417137dffecff8cd290bf3f6da30fe3
-
memory/2724-0-0x0000000000000000-mapping.dmp
-
memory/3832-2-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3832-3-0x0000000000446DCE-mapping.dmp