Analysis
-
max time kernel
85s -
max time network
75s -
platform
windows7_x64 -
resource
win7 -
submitted
10-07-2020 10:20
Static task
static1
Behavioral task
behavioral1
Sample
DOC.exe
Resource
win7
Behavioral task
behavioral2
Sample
DOC.exe
Resource
win10v200430
General
-
Target
DOC.exe
-
Size
440KB
-
MD5
20aa701748ce426b6818834da4b81db4
-
SHA1
3c221f46bf85db4f0cd3fa763928e2feaad19468
-
SHA256
f0bc738c905572cb05e4dc2004d86c69eb5e329bfbd7679e2f6c5306b5b7147a
-
SHA512
c7bba123a15748f55ada8a96b23ede5d590b53b1da32f4cbea4e6d099259ddf266cb375f39e2138ab26e9620b2a0c085ec40c1eec04a7b49699f90c3942cfc49
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
vicanto1994
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/812-4-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/812-5-0x0000000000446BEE-mapping.dmp family_agenttesla behavioral1/memory/812-6-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/812-7-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DOC.exedescription pid process target process PID 1104 set thread context of 812 1104 DOC.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 812 RegSvcs.exe 812 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 812 RegSvcs.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
DOC.exedescription pid process target process PID 1104 wrote to memory of 1504 1104 DOC.exe schtasks.exe PID 1104 wrote to memory of 1504 1104 DOC.exe schtasks.exe PID 1104 wrote to memory of 1504 1104 DOC.exe schtasks.exe PID 1104 wrote to memory of 1504 1104 DOC.exe schtasks.exe PID 1104 wrote to memory of 812 1104 DOC.exe RegSvcs.exe PID 1104 wrote to memory of 812 1104 DOC.exe RegSvcs.exe PID 1104 wrote to memory of 812 1104 DOC.exe RegSvcs.exe PID 1104 wrote to memory of 812 1104 DOC.exe RegSvcs.exe PID 1104 wrote to memory of 812 1104 DOC.exe RegSvcs.exe PID 1104 wrote to memory of 812 1104 DOC.exe RegSvcs.exe PID 1104 wrote to memory of 812 1104 DOC.exe RegSvcs.exe PID 1104 wrote to memory of 812 1104 DOC.exe RegSvcs.exe PID 1104 wrote to memory of 812 1104 DOC.exe RegSvcs.exe PID 1104 wrote to memory of 812 1104 DOC.exe RegSvcs.exe PID 1104 wrote to memory of 812 1104 DOC.exe RegSvcs.exe PID 1104 wrote to memory of 812 1104 DOC.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DOC.exe"C:\Users\Admin\AppData\Local\Temp\DOC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mSyNqWsN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8046.tmp"2⤵
- Creates scheduled task(s)
PID:1504 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:812
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
9b982b1abb55b4a172a0b7bcb6806379
SHA1cb1e6cb4cdc40a56afcb0f5c685d336510ca295d
SHA2567c8531c155751ae65fbfe713f4ee6b76290cfdc8e498611542f37749bb0e45e0
SHA5126e2a60d68f500b89a27b8b6f3067f3d2b041fbc26070c63e27574ec5f64b2e67a64f7d1c4d924a74ebcc9277b70a3f15be8a443a36e1f037c6209df5df7bd755