Analysis
-
max time kernel
116s -
max time network
124s -
platform
windows7_x64 -
resource
win7 -
submitted
10-07-2020 17:41
Static task
static1
Behavioral task
behavioral1
Sample
Original Shipping documents.exe
Resource
win7
Behavioral task
behavioral2
Sample
Original Shipping documents.exe
Resource
win10v200430
General
-
Target
Original Shipping documents.exe
-
Size
643KB
-
MD5
0d7eb830d496b29d26fdff1c5223d379
-
SHA1
7c6dcd3904a4c5e964b3617b78027e6f5b9996e1
-
SHA256
bc02ccc2308126e2b656f8ab033d7c0e188873aa42eb103e8cdf631ae6e36449
-
SHA512
1cc6668f5c36cfc386bc7f74dc2e56a8f579daf8df21a3cd3e7178218afd5df8d90de2a0629878e4fde27d03ffe6fc27662736faf00f1bcf78727494a87093ba
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.threewaystoharems.com - Port:
587 - Username:
[email protected] - Password:
sales@123456
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1036-2-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1036-3-0x000000000044737E-mapping.dmp family_agenttesla behavioral1/memory/1036-4-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1036-5-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Original Shipping documents.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\YYtJku = "C:\\Users\\Admin\\AppData\\Roaming\\YYtJku\\YYtJku.exe" Original Shipping documents.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Original Shipping documents.exedescription pid process target process PID 1464 set thread context of 1036 1464 Original Shipping documents.exe Original Shipping documents.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Original Shipping documents.exeOriginal Shipping documents.exepid process 1464 Original Shipping documents.exe 1464 Original Shipping documents.exe 1464 Original Shipping documents.exe 1464 Original Shipping documents.exe 1036 Original Shipping documents.exe 1036 Original Shipping documents.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Original Shipping documents.exepid process 1036 Original Shipping documents.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Original Shipping documents.exeOriginal Shipping documents.exedescription pid process Token: SeDebugPrivilege 1464 Original Shipping documents.exe Token: SeDebugPrivilege 1036 Original Shipping documents.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
Original Shipping documents.exedescription pid process target process PID 1464 wrote to memory of 336 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 336 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 336 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 336 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 736 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 736 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 736 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 736 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 324 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 324 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 324 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 324 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 1044 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 1044 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 1044 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 1044 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 1036 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 1036 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 1036 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 1036 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 1036 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 1036 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 1036 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 1036 1464 Original Shipping documents.exe Original Shipping documents.exe PID 1464 wrote to memory of 1036 1464 Original Shipping documents.exe Original Shipping documents.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Original Shipping documents.exe"C:\Users\Admin\AppData\Local\Temp\Original Shipping documents.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\Original Shipping documents.exe"{path}"2⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\Original Shipping documents.exe"{path}"2⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\Original Shipping documents.exe"{path}"2⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\Original Shipping documents.exe"{path}"2⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\Original Shipping documents.exe"{path}"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1036