Analysis
-
max time kernel
146s -
max time network
120s -
platform
windows7_x64 -
resource
win7 -
submitted
10-07-2020 13:30
Static task
static1
Behavioral task
behavioral1
Sample
PO 003217.jar.exe
Resource
win7
Behavioral task
behavioral2
Sample
PO 003217.jar.exe
Resource
win10
General
-
Target
PO 003217.jar.exe
-
Size
833KB
-
MD5
b2bf9a2231058ccce482b86f0ca2293c
-
SHA1
5c8eadeba17e779e327605c364351d60cb4dafbd
-
SHA256
91e462bedfc07bf6a3ef8d29aa240925cb9a31335c090bc92c0f5672307b72ee
-
SHA512
428c4722320f7b098f7e14d06ee0aa2360a813a7426badcdff4642eab8f59ed74518313c0f495114e6b4337e16e91dfd4bc1542c8f67cf53a322bb6883b03562
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PO 003217.jar.exedescription pid process Token: SeDebugPrivilege 1320 PO 003217.jar.exe -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Processes:
resource yara_rule behavioral1/memory/1320-2-0x0000000000400000-0x00000000004B1000-memory.dmp upx behavioral1/memory/1320-4-0x0000000000400000-0x00000000004B1000-memory.dmp upx behavioral1/memory/1320-5-0x0000000000400000-0x00000000004B1000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
PO 003217.jar.exePO 003217.jar.exepid process 1060 PO 003217.jar.exe 1320 PO 003217.jar.exe 1320 PO 003217.jar.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
PO 003217.jar.exepid process 1060 PO 003217.jar.exe -
Drops startup file 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ggk.vbs notepad.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
PO 003217.jar.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mymp4 = "C:\\Users\\Admin\\AppData\\Roaming\\Mymp4\\Mymp4.exe" PO 003217.jar.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
PO 003217.jar.exedescription pid process target process PID 1060 wrote to memory of 836 1060 PO 003217.jar.exe notepad.exe PID 1060 wrote to memory of 836 1060 PO 003217.jar.exe notepad.exe PID 1060 wrote to memory of 836 1060 PO 003217.jar.exe notepad.exe PID 1060 wrote to memory of 836 1060 PO 003217.jar.exe notepad.exe PID 1060 wrote to memory of 836 1060 PO 003217.jar.exe notepad.exe PID 1060 wrote to memory of 836 1060 PO 003217.jar.exe notepad.exe PID 1060 wrote to memory of 1320 1060 PO 003217.jar.exe PO 003217.jar.exe PID 1060 wrote to memory of 1320 1060 PO 003217.jar.exe PO 003217.jar.exe PID 1060 wrote to memory of 1320 1060 PO 003217.jar.exe PO 003217.jar.exe PID 1060 wrote to memory of 1320 1060 PO 003217.jar.exe PO 003217.jar.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO 003217.jar.exedescription pid process target process PID 1060 set thread context of 1320 1060 PO 003217.jar.exe PO 003217.jar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 003217.jar.exe"C:\Users\Admin\AppData\Local\Temp\PO 003217.jar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1060 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
PID:836 -
C:\Users\Admin\AppData\Local\Temp\PO 003217.jar.exe"C:\Users\Admin\AppData\Local\Temp\PO 003217.jar.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to start application
PID:1320