Analysis
-
max time kernel
86s -
max time network
62s -
platform
windows7_x64 -
resource
win7 -
submitted
08-07-2020 16:46
Static task
static1
Behavioral task
behavioral1
Sample
EQUIP MATERIALS.exe
Resource
win7
Behavioral task
behavioral2
Sample
EQUIP MATERIALS.exe
Resource
win10
General
-
Target
EQUIP MATERIALS.exe
-
Size
881KB
-
MD5
e837aefc96308f476f9c9fee984f0128
-
SHA1
4bae17624832e3c8928e4ae90a89c1868933620d
-
SHA256
f83df92f9d78101b5376837923351b70eb6581d4ee2b7bf251ef8a2387177064
-
SHA512
2c4178cd76546f54578bcf40c1f1ea0fed50b0fc7056d29df4005da8e88d14828f0120dccef2acf447cc7807d3ead898db87dd7b35f5c83a16d6e52a6a7ff51c
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
legend1234$$
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1596-2-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1596-3-0x0000000000447EBE-mapping.dmp family_agenttesla behavioral1/memory/1596-4-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1596-5-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
EQUIP MATERIALS.exedescription pid process target process PID 892 set thread context of 1596 892 EQUIP MATERIALS.exe EQUIP MATERIALS.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
EQUIP MATERIALS.exeEQUIP MATERIALS.exepid process 892 EQUIP MATERIALS.exe 1596 EQUIP MATERIALS.exe 1596 EQUIP MATERIALS.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
EQUIP MATERIALS.exepid process 1596 EQUIP MATERIALS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
EQUIP MATERIALS.exeEQUIP MATERIALS.exedescription pid process Token: SeDebugPrivilege 892 EQUIP MATERIALS.exe Token: SeDebugPrivilege 1596 EQUIP MATERIALS.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
EQUIP MATERIALS.exepid process 1596 EQUIP MATERIALS.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
EQUIP MATERIALS.exedescription pid process target process PID 892 wrote to memory of 1596 892 EQUIP MATERIALS.exe EQUIP MATERIALS.exe PID 892 wrote to memory of 1596 892 EQUIP MATERIALS.exe EQUIP MATERIALS.exe PID 892 wrote to memory of 1596 892 EQUIP MATERIALS.exe EQUIP MATERIALS.exe PID 892 wrote to memory of 1596 892 EQUIP MATERIALS.exe EQUIP MATERIALS.exe PID 892 wrote to memory of 1596 892 EQUIP MATERIALS.exe EQUIP MATERIALS.exe PID 892 wrote to memory of 1596 892 EQUIP MATERIALS.exe EQUIP MATERIALS.exe PID 892 wrote to memory of 1596 892 EQUIP MATERIALS.exe EQUIP MATERIALS.exe PID 892 wrote to memory of 1596 892 EQUIP MATERIALS.exe EQUIP MATERIALS.exe PID 892 wrote to memory of 1596 892 EQUIP MATERIALS.exe EQUIP MATERIALS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\EQUIP MATERIALS.exe"C:\Users\Admin\AppData\Local\Temp\EQUIP MATERIALS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EQUIP MATERIALS.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/892-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1596-2-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1596-3-0x0000000000447EBE-mapping.dmp
-
memory/1596-4-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1596-5-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB