Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 12:11
Static task
static1
Behavioral task
behavioral1
Sample
hesaphareketi001,pdf.exe
Resource
win7
Behavioral task
behavioral2
Sample
hesaphareketi001,pdf.exe
Resource
win10v200430
General
-
Target
hesaphareketi001,pdf.exe
-
Size
645KB
-
MD5
a24efe06eef9d062d226bf5eec6606d3
-
SHA1
beebac09e6663d88f36d39027a10b1512970f7f6
-
SHA256
8d98cc9cafea7bf31e27287f1002cbade82ac19f44d2b12584598509b8b10c99
-
SHA512
66059895c17a8edd0688977ab81ffa7056cbbda6cc8ad10fcfc51e0ea88a4f9c3d29d63864ebce52810bdf26101861f195842ce7ae14dce762586aac5c419dfa
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.cappac.com.tr - Port:
587 - Username:
[email protected] - Password:
aTlcLVD6nhEE
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 7 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\app.exe family_agenttesla C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\app.exe family_agenttesla C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\app.exe family_agenttesla behavioral1/memory/2004-14-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/2004-15-0x000000000044712E-mapping.dmp family_agenttesla behavioral1/memory/2004-17-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/2004-18-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Executes dropped EXE 2 IoCs
Processes:
app.exeRegAsm.exepid process 1852 app.exe 2004 RegAsm.exe -
Loads dropped DLL 3 IoCs
Processes:
hesaphareketi001,pdf.exeapp.exeRegAsm.exepid process 1448 hesaphareketi001,pdf.exe 1852 app.exe 2004 RegAsm.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\app = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\app.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
app.exedescription pid process target process PID 1852 set thread context of 2004 1852 app.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
hesaphareketi001,pdf.exeapp.exeRegAsm.exepid process 1448 hesaphareketi001,pdf.exe 1448 hesaphareketi001,pdf.exe 1448 hesaphareketi001,pdf.exe 1852 app.exe 1852 app.exe 1852 app.exe 2004 RegAsm.exe 2004 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
hesaphareketi001,pdf.exeapp.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1448 hesaphareketi001,pdf.exe Token: SeDebugPrivilege 1852 app.exe Token: SeDebugPrivilege 2004 RegAsm.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
hesaphareketi001,pdf.execmd.exeapp.exedescription pid process target process PID 1448 wrote to memory of 1132 1448 hesaphareketi001,pdf.exe cmd.exe PID 1448 wrote to memory of 1132 1448 hesaphareketi001,pdf.exe cmd.exe PID 1448 wrote to memory of 1132 1448 hesaphareketi001,pdf.exe cmd.exe PID 1448 wrote to memory of 1132 1448 hesaphareketi001,pdf.exe cmd.exe PID 1132 wrote to memory of 1536 1132 cmd.exe reg.exe PID 1132 wrote to memory of 1536 1132 cmd.exe reg.exe PID 1132 wrote to memory of 1536 1132 cmd.exe reg.exe PID 1132 wrote to memory of 1536 1132 cmd.exe reg.exe PID 1448 wrote to memory of 1852 1448 hesaphareketi001,pdf.exe app.exe PID 1448 wrote to memory of 1852 1448 hesaphareketi001,pdf.exe app.exe PID 1448 wrote to memory of 1852 1448 hesaphareketi001,pdf.exe app.exe PID 1448 wrote to memory of 1852 1448 hesaphareketi001,pdf.exe app.exe PID 1852 wrote to memory of 2004 1852 app.exe RegAsm.exe PID 1852 wrote to memory of 2004 1852 app.exe RegAsm.exe PID 1852 wrote to memory of 2004 1852 app.exe RegAsm.exe PID 1852 wrote to memory of 2004 1852 app.exe RegAsm.exe PID 1852 wrote to memory of 2004 1852 app.exe RegAsm.exe PID 1852 wrote to memory of 2004 1852 app.exe RegAsm.exe PID 1852 wrote to memory of 2004 1852 app.exe RegAsm.exe PID 1852 wrote to memory of 2004 1852 app.exe RegAsm.exe PID 1852 wrote to memory of 2004 1852 app.exe RegAsm.exe PID 1852 wrote to memory of 2004 1852 app.exe RegAsm.exe PID 1852 wrote to memory of 2004 1852 app.exe RegAsm.exe PID 1852 wrote to memory of 2004 1852 app.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\hesaphareketi001,pdf.exe"C:\Users\Admin\AppData\Local\Temp\hesaphareketi001,pdf.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v app /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\app.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v app /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\app.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\app.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\app.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeMD5
b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeMD5
b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\app.exeMD5
a24efe06eef9d062d226bf5eec6606d3
SHA1beebac09e6663d88f36d39027a10b1512970f7f6
SHA2568d98cc9cafea7bf31e27287f1002cbade82ac19f44d2b12584598509b8b10c99
SHA51266059895c17a8edd0688977ab81ffa7056cbbda6cc8ad10fcfc51e0ea88a4f9c3d29d63864ebce52810bdf26101861f195842ce7ae14dce762586aac5c419dfa
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\app.exeMD5
a24efe06eef9d062d226bf5eec6606d3
SHA1beebac09e6663d88f36d39027a10b1512970f7f6
SHA2568d98cc9cafea7bf31e27287f1002cbade82ac19f44d2b12584598509b8b10c99
SHA51266059895c17a8edd0688977ab81ffa7056cbbda6cc8ad10fcfc51e0ea88a4f9c3d29d63864ebce52810bdf26101861f195842ce7ae14dce762586aac5c419dfa
-
\Users\Admin\AppData\Local\Temp\RegAsm.exeMD5
b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
\Users\Admin\AppData\Local\Temp\RegAsm.exeMD5
b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA2566e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\app.exeMD5
a24efe06eef9d062d226bf5eec6606d3
SHA1beebac09e6663d88f36d39027a10b1512970f7f6
SHA2568d98cc9cafea7bf31e27287f1002cbade82ac19f44d2b12584598509b8b10c99
SHA51266059895c17a8edd0688977ab81ffa7056cbbda6cc8ad10fcfc51e0ea88a4f9c3d29d63864ebce52810bdf26101861f195842ce7ae14dce762586aac5c419dfa
-
memory/1132-3-0x0000000000000000-mapping.dmp
-
memory/1448-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1536-4-0x0000000000000000-mapping.dmp
-
memory/1852-6-0x0000000000000000-mapping.dmp
-
memory/2004-14-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2004-15-0x000000000044712E-mapping.dmp
-
memory/2004-17-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2004-18-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB