Analysis
-
max time kernel
123s -
max time network
52s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
08-07-2020 06:46
Static task
static1
Behavioral task
behavioral1
Sample
Transfer Form.scr
Resource
win7v200430
Behavioral task
behavioral2
Sample
Transfer Form.scr
Resource
win10
General
-
Target
Transfer Form.scr
-
Size
959KB
-
MD5
de18b7e07da179adb8c5c3be4698f2be
-
SHA1
331e367ccf667e27ccbb253a09e2dd91597811d7
-
SHA256
d5434b833a6b29c1f83aee2a0c8c5584467e495e452f7e6e676235b7e4870033
-
SHA512
0f086bf6eafbff463ec6484c80317421f41e3b8b9e5dd62778dbd1f08e59e6bfaacad0c0eeed4d3228984450dbb7fae2fa6430e6a40c10929a14b82691448cb5
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.northwestpowdercoating.co.uk - Port:
587 - Username:
[email protected] - Password:
C^0z.^LxykTW
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
resource yara_rule behavioral1/memory/1760-4-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1760-5-0x0000000000447ABE-mapping.dmp family_agenttesla behavioral1/memory/1760-6-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1760-7-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1388 set thread context of 1760 1388 Transfer Form.scr 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1852 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1760 Transfer Form.scr 1760 Transfer Form.scr -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1760 Transfer Form.scr -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1760 Transfer Form.scr -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1388 wrote to memory of 1852 1388 Transfer Form.scr 26 PID 1388 wrote to memory of 1852 1388 Transfer Form.scr 26 PID 1388 wrote to memory of 1852 1388 Transfer Form.scr 26 PID 1388 wrote to memory of 1852 1388 Transfer Form.scr 26 PID 1388 wrote to memory of 1760 1388 Transfer Form.scr 28 PID 1388 wrote to memory of 1760 1388 Transfer Form.scr 28 PID 1388 wrote to memory of 1760 1388 Transfer Form.scr 28 PID 1388 wrote to memory of 1760 1388 Transfer Form.scr 28 PID 1388 wrote to memory of 1760 1388 Transfer Form.scr 28 PID 1388 wrote to memory of 1760 1388 Transfer Form.scr 28 PID 1388 wrote to memory of 1760 1388 Transfer Form.scr 28 PID 1388 wrote to memory of 1760 1388 Transfer Form.scr 28 PID 1388 wrote to memory of 1760 1388 Transfer Form.scr 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Transfer Form.scr"C:\Users\Admin\AppData\Local\Temp\Transfer Form.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XNGJlBsYqshWIX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp783B.tmp"2⤵
- Creates scheduled task(s)
PID:1852
-
-
C:\Users\Admin\AppData\Local\Temp\Transfer Form.scr"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1760
-