Analysis
-
max time kernel
85s -
max time network
54s -
platform
windows7_x64 -
resource
win7 -
submitted
13-07-2020 06:56
Static task
static1
Behavioral task
behavioral1
Sample
Consignment Details.exe
Resource
win7
Behavioral task
behavioral2
Sample
Consignment Details.exe
Resource
win10v200430
General
-
Target
Consignment Details.exe
-
Size
749KB
-
MD5
c7815c67215eeff2d7921732430b29dd
-
SHA1
8907672399e0e185b757609787d9ad4abc3a7df1
-
SHA256
278250bba959af72e51bd0157fdebee43d2d584ecc557e2b54dbc03ae9958086
-
SHA512
43a73bf3dd38bf0173b714408054b5b12be50b0305d156c4c174a8751e20b7fda70707b7506028702b7a25c6c2fc902f7f5f52bbbcc6617e1540f480349d00d7
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.flood-protection.org - Port:
587 - Username:
[email protected] - Password:
clark2424@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1500-3-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla behavioral1/memory/1500-4-0x000000000044A9BE-mapping.dmp family_agenttesla behavioral1/memory/1500-5-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla behavioral1/memory/1500-6-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Consignment Details.exedescription pid process target process PID 1156 set thread context of 1500 1156 Consignment Details.exe Consignment Details.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Consignment Details.exeConsignment Details.exepid process 1156 Consignment Details.exe 1156 Consignment Details.exe 1156 Consignment Details.exe 1500 Consignment Details.exe 1500 Consignment Details.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Consignment Details.exeConsignment Details.exedescription pid process Token: SeDebugPrivilege 1156 Consignment Details.exe Token: SeDebugPrivilege 1500 Consignment Details.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Consignment Details.exeConsignment Details.exedescription pid process target process PID 1156 wrote to memory of 1500 1156 Consignment Details.exe Consignment Details.exe PID 1156 wrote to memory of 1500 1156 Consignment Details.exe Consignment Details.exe PID 1156 wrote to memory of 1500 1156 Consignment Details.exe Consignment Details.exe PID 1156 wrote to memory of 1500 1156 Consignment Details.exe Consignment Details.exe PID 1156 wrote to memory of 1500 1156 Consignment Details.exe Consignment Details.exe PID 1156 wrote to memory of 1500 1156 Consignment Details.exe Consignment Details.exe PID 1156 wrote to memory of 1500 1156 Consignment Details.exe Consignment Details.exe PID 1156 wrote to memory of 1500 1156 Consignment Details.exe Consignment Details.exe PID 1156 wrote to memory of 1500 1156 Consignment Details.exe Consignment Details.exe PID 1500 wrote to memory of 1952 1500 Consignment Details.exe netsh.exe PID 1500 wrote to memory of 1952 1500 Consignment Details.exe netsh.exe PID 1500 wrote to memory of 1952 1500 Consignment Details.exe netsh.exe PID 1500 wrote to memory of 1952 1500 Consignment Details.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵PID:1952
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1156-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1500-3-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1500-4-0x000000000044A9BE-mapping.dmp
-
memory/1500-5-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1500-6-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1952-7-0x0000000000000000-mapping.dmp