Analysis
-
max time kernel
137s -
max time network
31s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
09-07-2020 06:30
Static task
static1
Behavioral task
behavioral1
Sample
Order Specifications.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
Order Specifications.exe
Resource
win10
General
-
Target
Order Specifications.exe
-
Size
711KB
-
MD5
5350d9dedce9039a41a8d5c1e9cb8f20
-
SHA1
47e845b83e0c561e42b73e0a8a54d0e3c9ad25b5
-
SHA256
3228552bf12eac0d0d241b72489b37b6f25e4f3fca6e7867a3dbc2b912f404fe
-
SHA512
46cefb5c1c7e0f8611afd21fea910430e299d4eb3761c507ca24ac35c6466f3cb9ea2f2c6d3dd6c49d8cb2bea248bbdbe9195a6171a5c7fb0308af8d498fad5c
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
premium57.web-hosting.com - Port:
587 - Username:
[email protected] - Password:
Goodboy123??
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1892-4-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1892-5-0x0000000000446E5E-mapping.dmp family_agenttesla behavioral1/memory/1892-6-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1892-7-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order Specifications.exedescription pid process target process PID 1032 set thread context of 1892 1032 Order Specifications.exe Order Specifications.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Order Specifications.exeOrder Specifications.exepid process 1032 Order Specifications.exe 1892 Order Specifications.exe 1892 Order Specifications.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order Specifications.exeOrder Specifications.exedescription pid process Token: SeDebugPrivilege 1032 Order Specifications.exe Token: SeDebugPrivilege 1892 Order Specifications.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Order Specifications.exepid process 1892 Order Specifications.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Order Specifications.exedescription pid process target process PID 1032 wrote to memory of 1856 1032 Order Specifications.exe schtasks.exe PID 1032 wrote to memory of 1856 1032 Order Specifications.exe schtasks.exe PID 1032 wrote to memory of 1856 1032 Order Specifications.exe schtasks.exe PID 1032 wrote to memory of 1856 1032 Order Specifications.exe schtasks.exe PID 1032 wrote to memory of 1892 1032 Order Specifications.exe Order Specifications.exe PID 1032 wrote to memory of 1892 1032 Order Specifications.exe Order Specifications.exe PID 1032 wrote to memory of 1892 1032 Order Specifications.exe Order Specifications.exe PID 1032 wrote to memory of 1892 1032 Order Specifications.exe Order Specifications.exe PID 1032 wrote to memory of 1892 1032 Order Specifications.exe Order Specifications.exe PID 1032 wrote to memory of 1892 1032 Order Specifications.exe Order Specifications.exe PID 1032 wrote to memory of 1892 1032 Order Specifications.exe Order Specifications.exe PID 1032 wrote to memory of 1892 1032 Order Specifications.exe Order Specifications.exe PID 1032 wrote to memory of 1892 1032 Order Specifications.exe Order Specifications.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order Specifications.exe"C:\Users\Admin\AppData\Local\Temp\Order Specifications.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DusOaszsqZvAQE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6B01.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Order Specifications.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6B01.tmpMD5
a18817b210edcfdfedda9307ef787f9b
SHA163affa8e4f38d329d8b14045487b8f764426a86e
SHA25687bc038a92db14670cdba947cd934fa4ef8934a06c5edeee535c42fa3ff13e64
SHA512160e2709124034f2436eb33620a7ed80ea469ae7889db7b28baae62aa1ccb5385f89a39dd46b69594dd5f232eb593d59efaf1f31560f078b350162e04f6d47fc
-
memory/1032-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1856-2-0x0000000000000000-mapping.dmp
-
memory/1892-4-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1892-5-0x0000000000446E5E-mapping.dmp
-
memory/1892-6-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1892-7-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB