Analysis
-
max time kernel
114s -
max time network
120s -
platform
windows7_x64 -
resource
win7 -
submitted
11-07-2020 06:00
Static task
static1
Behavioral task
behavioral1
Sample
shipping document.exe
Resource
win7
Behavioral task
behavioral2
Sample
shipping document.exe
Resource
win10v200430
General
-
Target
shipping document.exe
-
Size
491KB
-
MD5
234b06c483e9c1677556b38cd0550dee
-
SHA1
b9d5edaa27a892f835141fc64e48dc767e62eefa
-
SHA256
391272018c37c88ce5c0921a9881695fbae09611ce443f12db516963012da380
-
SHA512
d5058790b660d7592c2f009ca7bcf86d290ea1852e773bceaeae8c3f82ac186ead94b9cb980a0674498d012aa95623982a539961983a463756d4185807433283
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.pierreinsurancebrokers.com - Port:
587 - Username:
[email protected] - Password:
advisor@1234
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1796-4-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1796-5-0x0000000000446C5E-mapping.dmp family_agenttesla behavioral1/memory/1796-6-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1796-7-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
shipping document.exedescription pid process target process PID 1612 set thread context of 1796 1612 shipping document.exe shipping document.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
shipping document.exeshipping document.exepid process 1612 shipping document.exe 1796 shipping document.exe 1796 shipping document.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
shipping document.exeshipping document.exedescription pid process Token: SeDebugPrivilege 1612 shipping document.exe Token: SeDebugPrivilege 1796 shipping document.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
shipping document.exedescription pid process target process PID 1612 wrote to memory of 1316 1612 shipping document.exe schtasks.exe PID 1612 wrote to memory of 1316 1612 shipping document.exe schtasks.exe PID 1612 wrote to memory of 1316 1612 shipping document.exe schtasks.exe PID 1612 wrote to memory of 1316 1612 shipping document.exe schtasks.exe PID 1612 wrote to memory of 1796 1612 shipping document.exe shipping document.exe PID 1612 wrote to memory of 1796 1612 shipping document.exe shipping document.exe PID 1612 wrote to memory of 1796 1612 shipping document.exe shipping document.exe PID 1612 wrote to memory of 1796 1612 shipping document.exe shipping document.exe PID 1612 wrote to memory of 1796 1612 shipping document.exe shipping document.exe PID 1612 wrote to memory of 1796 1612 shipping document.exe shipping document.exe PID 1612 wrote to memory of 1796 1612 shipping document.exe shipping document.exe PID 1612 wrote to memory of 1796 1612 shipping document.exe shipping document.exe PID 1612 wrote to memory of 1796 1612 shipping document.exe shipping document.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\shipping document.exe"C:\Users\Admin\AppData\Local\Temp\shipping document.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bqWNpOSfDy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8F53.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\shipping document.exe"C:\Users\Admin\AppData\Local\Temp\shipping document.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8F53.tmpMD5
becf40709f973fd6d0030b36e178befb
SHA1eb9597f3a2439fa772521e13ea8fdb78bb7195ae
SHA2561daebe6414eb090c797635ddf27672ef4bc581b932c4d7137700956fb4821789
SHA5121eee2a55d323d3a99587fe8a2048b0651b959814a4eb84fe37b409a870de2fe85ef62114a1f77f8b51a6ce1417a8142bce85ecdaf87961d3862734c5adbfb12f
-
memory/1316-2-0x0000000000000000-mapping.dmp
-
memory/1612-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1796-4-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1796-5-0x0000000000446C5E-mapping.dmp
-
memory/1796-6-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1796-7-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB