Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10_x64 -
resource
win10 -
submitted
10-07-2020 07:06
Static task
static1
Behavioral task
behavioral1
Sample
PO 003217.jar.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
PO 003217.jar.exe
Resource
win10
General
-
Target
PO 003217.jar.exe
-
Size
833KB
-
MD5
b2bf9a2231058ccce482b86f0ca2293c
-
SHA1
5c8eadeba17e779e327605c364351d60cb4dafbd
-
SHA256
91e462bedfc07bf6a3ef8d29aa240925cb9a31335c090bc92c0f5672307b72ee
-
SHA512
428c4722320f7b098f7e14d06ee0aa2360a813a7426badcdff4642eab8f59ed74518313c0f495114e6b4337e16e91dfd4bc1542c8f67cf53a322bb6883b03562
Malware Config
Extracted
Protocol: smtp- Host:
smtp.bnb-spa.com - Port:
587 - Username:
[email protected] - Password:
hope2020
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
PO 003217.jar.exePO 003217.jar.exepid process 3588 PO 003217.jar.exe 3588 PO 003217.jar.exe 4068 PO 003217.jar.exe 4068 PO 003217.jar.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
PO 003217.jar.exepid process 3588 PO 003217.jar.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO 003217.jar.exedescription pid process target process PID 3588 set thread context of 4068 3588 PO 003217.jar.exe PO 003217.jar.exe -
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
Processes:
resource yara_rule behavioral2/memory/4068-1-0x0000000000400000-0x00000000004B1000-memory.dmp upx behavioral2/memory/4068-3-0x0000000000400000-0x00000000004B1000-memory.dmp upx behavioral2/memory/4068-4-0x0000000000400000-0x00000000004B1000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
PO 003217.jar.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mymp4 = "C:\\Users\\Admin\\AppData\\Roaming\\Mymp4\\Mymp4.exe" PO 003217.jar.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
PO 003217.jar.exedescription pid process target process PID 3588 wrote to memory of 4012 3588 PO 003217.jar.exe notepad.exe PID 3588 wrote to memory of 4012 3588 PO 003217.jar.exe notepad.exe PID 3588 wrote to memory of 4012 3588 PO 003217.jar.exe notepad.exe PID 3588 wrote to memory of 4012 3588 PO 003217.jar.exe notepad.exe PID 3588 wrote to memory of 4012 3588 PO 003217.jar.exe notepad.exe PID 3588 wrote to memory of 4068 3588 PO 003217.jar.exe PO 003217.jar.exe PID 3588 wrote to memory of 4068 3588 PO 003217.jar.exe PO 003217.jar.exe PID 3588 wrote to memory of 4068 3588 PO 003217.jar.exe PO 003217.jar.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PO 003217.jar.exedescription pid process Token: SeDebugPrivilege 4068 PO 003217.jar.exe -
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops startup file 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ggk.vbs notepad.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 003217.jar.exe"C:\Users\Admin\AppData\Local\Temp\PO 003217.jar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\PO 003217.jar.exe"C:\Users\Admin\AppData\Local\Temp\PO 003217.jar.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to start application
- Suspicious use of AdjustPrivilegeToken
PID:4068