Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10_x64 -
resource
win10 -
submitted
10-07-2020 13:30
Static task
static1
Behavioral task
behavioral1
Sample
PO 003217.jar.exe
Resource
win7
Behavioral task
behavioral2
Sample
PO 003217.jar.exe
Resource
win10
General
-
Target
PO 003217.jar.exe
-
Size
833KB
-
MD5
b2bf9a2231058ccce482b86f0ca2293c
-
SHA1
5c8eadeba17e779e327605c364351d60cb4dafbd
-
SHA256
91e462bedfc07bf6a3ef8d29aa240925cb9a31335c090bc92c0f5672307b72ee
-
SHA512
428c4722320f7b098f7e14d06ee0aa2360a813a7426badcdff4642eab8f59ed74518313c0f495114e6b4337e16e91dfd4bc1542c8f67cf53a322bb6883b03562
Malware Config
Extracted
Protocol: smtp- Host:
smtp.bnb-spa.com - Port:
587 - Username:
[email protected] - Password:
hope2020
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
PO 003217.jar.exePO 003217.jar.exepid process 2944 PO 003217.jar.exe 2944 PO 003217.jar.exe 3108 PO 003217.jar.exe 3108 PO 003217.jar.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO 003217.jar.exedescription pid process target process PID 2944 set thread context of 3108 2944 PO 003217.jar.exe PO 003217.jar.exe -
Drops startup file 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ggk.vbs notepad.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
PO 003217.jar.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mymp4 = "C:\\Users\\Admin\\AppData\\Roaming\\Mymp4\\Mymp4.exe" PO 003217.jar.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
PO 003217.jar.exedescription pid process target process PID 2944 wrote to memory of 1968 2944 PO 003217.jar.exe notepad.exe PID 2944 wrote to memory of 1968 2944 PO 003217.jar.exe notepad.exe PID 2944 wrote to memory of 1968 2944 PO 003217.jar.exe notepad.exe PID 2944 wrote to memory of 1968 2944 PO 003217.jar.exe notepad.exe PID 2944 wrote to memory of 1968 2944 PO 003217.jar.exe notepad.exe PID 2944 wrote to memory of 3108 2944 PO 003217.jar.exe PO 003217.jar.exe PID 2944 wrote to memory of 3108 2944 PO 003217.jar.exe PO 003217.jar.exe PID 2944 wrote to memory of 3108 2944 PO 003217.jar.exe PO 003217.jar.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
PO 003217.jar.exepid process 2944 PO 003217.jar.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PO 003217.jar.exedescription pid process Token: SeDebugPrivilege 3108 PO 003217.jar.exe -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Processes:
resource yara_rule behavioral2/memory/3108-1-0x0000000000400000-0x00000000004B1000-memory.dmp upx behavioral2/memory/3108-3-0x0000000000400000-0x00000000004B1000-memory.dmp upx behavioral2/memory/3108-4-0x0000000000400000-0x00000000004B1000-memory.dmp upx
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 003217.jar.exe"C:\Users\Admin\AppData\Local\Temp\PO 003217.jar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:2944 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\PO 003217.jar.exe"C:\Users\Admin\AppData\Local\Temp\PO 003217.jar.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to start application
- Suspicious use of AdjustPrivilegeToken
PID:3108