Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
08-07-2020 06:17
Static task
static1
Behavioral task
behavioral1
Sample
AWB 673687387678.exe
Resource
win7v200430
General
-
Target
AWB 673687387678.exe
-
Size
419KB
-
MD5
42a1bf57e59510b27b6128f1edc76fa7
-
SHA1
612f8808225a78dab158eeab15fcc1a9635ecb70
-
SHA256
2409f04509b447f04121091d6b20dde5291413f155de031ef7e306c736ed9242
-
SHA512
504f1c1461a40f7e3cdc4fcad8cca3f25e991edceefb2021b7c028a1d664284275c40a7d86b32e03c97d3d9ecb56cc0d72e9c9d5826c938ec111788e0426f3f9
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.papayatreehotels.com - Port:
587 - Username:
[email protected] - Password:
tree1579
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2036-3-0x0000000000400000-0x00000000004A4000-memory.dmp family_agenttesla behavioral2/memory/2036-4-0x00000000009F0000-0x0000000000A3C000-memory.dmp family_agenttesla -
Processes:
resource yara_rule behavioral2/memory/2036-0-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/2036-2-0x0000000000400000-0x00000000004A4000-memory.dmp upx behavioral2/memory/2036-3-0x0000000000400000-0x00000000004A4000-memory.dmp upx -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
AWB 673687387678.exedescription pid process target process PID 3848 set thread context of 2036 3848 AWB 673687387678.exe AWB 673687387678.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
AWB 673687387678.exeAWB 673687387678.exepid process 3848 AWB 673687387678.exe 3848 AWB 673687387678.exe 2036 AWB 673687387678.exe 2036 AWB 673687387678.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
AWB 673687387678.exepid process 3848 AWB 673687387678.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AWB 673687387678.exedescription pid process Token: SeDebugPrivilege 2036 AWB 673687387678.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
AWB 673687387678.exedescription pid process target process PID 3848 wrote to memory of 2036 3848 AWB 673687387678.exe AWB 673687387678.exe PID 3848 wrote to memory of 2036 3848 AWB 673687387678.exe AWB 673687387678.exe PID 3848 wrote to memory of 2036 3848 AWB 673687387678.exe AWB 673687387678.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AWB 673687387678.exe"C:\Users\Admin\AppData\Local\Temp\AWB 673687387678.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AWB 673687387678.exe"C:\Users\Admin\AppData\Local\Temp\AWB 673687387678.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2036-0-0x0000000000400000-0x00000000004A4000-memory.dmpFilesize
656KB
-
memory/2036-1-0x00000000004A2540-mapping.dmp
-
memory/2036-2-0x0000000000400000-0x00000000004A4000-memory.dmpFilesize
656KB
-
memory/2036-3-0x0000000000400000-0x00000000004A4000-memory.dmpFilesize
656KB
-
memory/2036-4-0x00000000009F0000-0x0000000000A3C000-memory.dmpFilesize
304KB
-
memory/2036-5-0x0000000000782000-0x0000000000783000-memory.dmpFilesize
4KB