Analysis
-
max time kernel
123s -
max time network
52s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
08-07-2020 06:46
Static task
static1
Behavioral task
behavioral1
Sample
Transfer Form.scr
Resource
win7v200430
Behavioral task
behavioral2
Sample
Transfer Form.scr
Resource
win10
General
-
Target
Transfer Form.scr
-
Size
959KB
-
MD5
de18b7e07da179adb8c5c3be4698f2be
-
SHA1
331e367ccf667e27ccbb253a09e2dd91597811d7
-
SHA256
d5434b833a6b29c1f83aee2a0c8c5584467e495e452f7e6e676235b7e4870033
-
SHA512
0f086bf6eafbff463ec6484c80317421f41e3b8b9e5dd62778dbd1f08e59e6bfaacad0c0eeed4d3228984450dbb7fae2fa6430e6a40c10929a14b82691448cb5
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.northwestpowdercoating.co.uk - Port:
587 - Username:
[email protected] - Password:
C^0z.^LxykTW
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1760-4-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1760-5-0x0000000000447ABE-mapping.dmp family_agenttesla behavioral1/memory/1760-6-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1760-7-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Transfer Form.scrdescription pid process target process PID 1388 set thread context of 1760 1388 Transfer Form.scr Transfer Form.scr -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Transfer Form.scrpid process 1760 Transfer Form.scr 1760 Transfer Form.scr -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Transfer Form.scrdescription pid process Token: SeDebugPrivilege 1760 Transfer Form.scr -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Transfer Form.scrpid process 1760 Transfer Form.scr -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Transfer Form.scrdescription pid process target process PID 1388 wrote to memory of 1852 1388 Transfer Form.scr schtasks.exe PID 1388 wrote to memory of 1852 1388 Transfer Form.scr schtasks.exe PID 1388 wrote to memory of 1852 1388 Transfer Form.scr schtasks.exe PID 1388 wrote to memory of 1852 1388 Transfer Form.scr schtasks.exe PID 1388 wrote to memory of 1760 1388 Transfer Form.scr Transfer Form.scr PID 1388 wrote to memory of 1760 1388 Transfer Form.scr Transfer Form.scr PID 1388 wrote to memory of 1760 1388 Transfer Form.scr Transfer Form.scr PID 1388 wrote to memory of 1760 1388 Transfer Form.scr Transfer Form.scr PID 1388 wrote to memory of 1760 1388 Transfer Form.scr Transfer Form.scr PID 1388 wrote to memory of 1760 1388 Transfer Form.scr Transfer Form.scr PID 1388 wrote to memory of 1760 1388 Transfer Form.scr Transfer Form.scr PID 1388 wrote to memory of 1760 1388 Transfer Form.scr Transfer Form.scr PID 1388 wrote to memory of 1760 1388 Transfer Form.scr Transfer Form.scr
Processes
-
C:\Users\Admin\AppData\Local\Temp\Transfer Form.scr"C:\Users\Admin\AppData\Local\Temp\Transfer Form.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XNGJlBsYqshWIX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp783B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Transfer Form.scr"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp783B.tmpMD5
3bc57af9ea0a5a6dd156c172ae23501d
SHA1fdbffe58d8f82ae6871ab81f2b0cd6cc3ce95bbe
SHA256adbd50927de854b93cf318c759010dce505a5a4fde7cc723cb0e2089be857f59
SHA512fdb2ab0940ee6f9aa0f1026e0319c0a22bfcb9fd09bd4f62988eac3622edabfa4e0928cefb33530c97819b0bac750672341a723ee343fd63b3aaedbcadd10e7d
-
memory/1388-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1760-4-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1760-5-0x0000000000447ABE-mapping.dmp
-
memory/1760-6-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1760-7-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1852-2-0x0000000000000000-mapping.dmp