Analysis
-
max time kernel
114s -
max time network
119s -
platform
windows7_x64 -
resource
win7 -
submitted
13-07-2020 06:55
Static task
static1
Behavioral task
behavioral1
Sample
Order WJ200702.exe
Resource
win7
Behavioral task
behavioral2
Sample
Order WJ200702.exe
Resource
win10
General
-
Target
Order WJ200702.exe
-
Size
565KB
-
MD5
220eb9868bc36d7369a16381934de66c
-
SHA1
1a60df1e7ebe11b072c6d71c86d1bb4e2e975293
-
SHA256
c60f9a3c78588d75a17c74eac45f113259702d485d5d58ab6a5154ad424193f6
-
SHA512
3068c2990e7ca596faab8572bc717c8c657fc7721ce9897130ebaaa791ac27a6706971872743c6cb6260bd7ae6cffaaeee001acbb62678376eb86c3856a8eccd
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.kimberleygroupbd.com - Port:
587 - Username:
[email protected] - Password:
QDx{5M]}9]-J
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1080-4-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1080-5-0x0000000000446CAE-mapping.dmp family_agenttesla behavioral1/memory/1080-6-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1080-7-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order WJ200702.exedescription pid process target process PID 316 set thread context of 1080 316 Order WJ200702.exe Order WJ200702.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Order WJ200702.exeOrder WJ200702.exepid process 316 Order WJ200702.exe 1080 Order WJ200702.exe 1080 Order WJ200702.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order WJ200702.exeOrder WJ200702.exedescription pid process Token: SeDebugPrivilege 316 Order WJ200702.exe Token: SeDebugPrivilege 1080 Order WJ200702.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Order WJ200702.exedescription pid process target process PID 316 wrote to memory of 784 316 Order WJ200702.exe schtasks.exe PID 316 wrote to memory of 784 316 Order WJ200702.exe schtasks.exe PID 316 wrote to memory of 784 316 Order WJ200702.exe schtasks.exe PID 316 wrote to memory of 784 316 Order WJ200702.exe schtasks.exe PID 316 wrote to memory of 1080 316 Order WJ200702.exe Order WJ200702.exe PID 316 wrote to memory of 1080 316 Order WJ200702.exe Order WJ200702.exe PID 316 wrote to memory of 1080 316 Order WJ200702.exe Order WJ200702.exe PID 316 wrote to memory of 1080 316 Order WJ200702.exe Order WJ200702.exe PID 316 wrote to memory of 1080 316 Order WJ200702.exe Order WJ200702.exe PID 316 wrote to memory of 1080 316 Order WJ200702.exe Order WJ200702.exe PID 316 wrote to memory of 1080 316 Order WJ200702.exe Order WJ200702.exe PID 316 wrote to memory of 1080 316 Order WJ200702.exe Order WJ200702.exe PID 316 wrote to memory of 1080 316 Order WJ200702.exe Order WJ200702.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order WJ200702.exe"C:\Users\Admin\AppData\Local\Temp\Order WJ200702.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\odNcgiw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpACC2.tmp"2⤵
- Creates scheduled task(s)
PID:784 -
C:\Users\Admin\AppData\Local\Temp\Order WJ200702.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1080
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpACC2.tmpMD5
7fcded1df65e89c69ccca23d02692cac
SHA1c39ef9df7ef06c9ac4ca1cbed34f1b77444fec51
SHA2565a34000fb21c2c2df1d0d8cabc2bbc13a52e3f7830908d07f444f5c339389ee3
SHA5127f2bf24b0ab79f58ef08a83ddfe5cfe11bd0fea452e892c0e0032afb0c65714f275dd43c16aa65fd4672449751e7c56be726c28877e4067647430bd10de166f5
-
memory/316-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/784-2-0x0000000000000000-mapping.dmp
-
memory/1080-4-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1080-5-0x0000000000446CAE-mapping.dmp
-
memory/1080-6-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1080-7-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB