Analysis
-
max time kernel
57s -
max time network
71s -
platform
windows7_x64 -
resource
win7 -
submitted
31-07-2020 10:18
Static task
static1
Behavioral task
behavioral1
Sample
Original Shipping Documents.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Original Shipping Documents.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
Original Shipping Documents.exe
-
Size
787KB
-
MD5
24d470040d22bbff52a8388c96ede9c4
-
SHA1
a58d9c3007c2316676f0ca1c43eb1da94a8d0aff
-
SHA256
d1acb47d2f3d3f08def6a48de5ee5cd09cae41a8c0ad42553e83c3c36a98bba0
-
SHA512
d1aacfc74db02e9c382766287531b00846c8c5c965f156a3df711ddfd94bd00c17ff5f315aad959f4ff04c98fc91d31f482d5be10eaf5ca1099433c5af86f860
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
gamzyolowo@yandex.com - Password:
chikaaka1
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1036-2-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla behavioral1/memory/1036-3-0x000000000044A09E-mapping.dmp family_agenttesla behavioral1/memory/1036-4-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla behavioral1/memory/1036-5-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Original Shipping Documents.exedescription pid process target process PID 1424 set thread context of 1036 1424 Original Shipping Documents.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Original Shipping Documents.exeRegSvcs.exepid process 1424 Original Shipping Documents.exe 1424 Original Shipping Documents.exe 1424 Original Shipping Documents.exe 1424 Original Shipping Documents.exe 1036 RegSvcs.exe 1036 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Original Shipping Documents.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1424 Original Shipping Documents.exe Token: SeDebugPrivilege 1036 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Original Shipping Documents.exedescription pid process target process PID 1424 wrote to memory of 1036 1424 Original Shipping Documents.exe RegSvcs.exe PID 1424 wrote to memory of 1036 1424 Original Shipping Documents.exe RegSvcs.exe PID 1424 wrote to memory of 1036 1424 Original Shipping Documents.exe RegSvcs.exe PID 1424 wrote to memory of 1036 1424 Original Shipping Documents.exe RegSvcs.exe PID 1424 wrote to memory of 1036 1424 Original Shipping Documents.exe RegSvcs.exe PID 1424 wrote to memory of 1036 1424 Original Shipping Documents.exe RegSvcs.exe PID 1424 wrote to memory of 1036 1424 Original Shipping Documents.exe RegSvcs.exe PID 1424 wrote to memory of 1036 1424 Original Shipping Documents.exe RegSvcs.exe PID 1424 wrote to memory of 1036 1424 Original Shipping Documents.exe RegSvcs.exe PID 1424 wrote to memory of 1036 1424 Original Shipping Documents.exe RegSvcs.exe PID 1424 wrote to memory of 1036 1424 Original Shipping Documents.exe RegSvcs.exe PID 1424 wrote to memory of 1036 1424 Original Shipping Documents.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Original Shipping Documents.exe"C:\Users\Admin\AppData\Local\Temp\Original Shipping Documents.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1036-2-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1036-3-0x000000000044A09E-mapping.dmp
-
memory/1036-4-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1036-5-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1424-1-0x0000000000000000-0x0000000000000000-disk.dmp