Analysis
-
max time kernel
61s -
max time network
51s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
31-07-2020 10:55
Static task
static1
Behavioral task
behavioral1
Sample
TNT DOCUMENT.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
TNT DOCUMENT.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
TNT DOCUMENT.exe
-
Size
507KB
-
MD5
75149b45dbd194d67dd279d0b322bdf8
-
SHA1
074f248b7f169d44b31dd38a348fdf08e5bad6a3
-
SHA256
f61ea2b82ddad99865b46c4a79b1f0e54c7ed82389fc3bbe5e346310b47f6355
-
SHA512
5bfe7bc12f36d56eb92e7eb85229e1fd7f31503f7a25c23dd33529d77ba94d47a3110f188ce979dfaaaaefbb38b39aa73ccd7ee322569decf6c4a40e4300e31f
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
gamzyolowo@yandex.com - Password:
chikaaka1
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1228-2-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla behavioral1/memory/1228-3-0x000000000044A09E-mapping.dmp family_agenttesla behavioral1/memory/1228-4-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla behavioral1/memory/1228-5-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
TNT DOCUMENT.exedescription pid process target process PID 852 set thread context of 1228 852 TNT DOCUMENT.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
TNT DOCUMENT.exeRegSvcs.exepid process 852 TNT DOCUMENT.exe 852 TNT DOCUMENT.exe 852 TNT DOCUMENT.exe 1228 RegSvcs.exe 1228 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
TNT DOCUMENT.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 852 TNT DOCUMENT.exe Token: SeDebugPrivilege 1228 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
TNT DOCUMENT.exedescription pid process target process PID 852 wrote to memory of 1228 852 TNT DOCUMENT.exe RegSvcs.exe PID 852 wrote to memory of 1228 852 TNT DOCUMENT.exe RegSvcs.exe PID 852 wrote to memory of 1228 852 TNT DOCUMENT.exe RegSvcs.exe PID 852 wrote to memory of 1228 852 TNT DOCUMENT.exe RegSvcs.exe PID 852 wrote to memory of 1228 852 TNT DOCUMENT.exe RegSvcs.exe PID 852 wrote to memory of 1228 852 TNT DOCUMENT.exe RegSvcs.exe PID 852 wrote to memory of 1228 852 TNT DOCUMENT.exe RegSvcs.exe PID 852 wrote to memory of 1228 852 TNT DOCUMENT.exe RegSvcs.exe PID 852 wrote to memory of 1228 852 TNT DOCUMENT.exe RegSvcs.exe PID 852 wrote to memory of 1228 852 TNT DOCUMENT.exe RegSvcs.exe PID 852 wrote to memory of 1228 852 TNT DOCUMENT.exe RegSvcs.exe PID 852 wrote to memory of 1228 852 TNT DOCUMENT.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TNT DOCUMENT.exe"C:\Users\Admin\AppData\Local\Temp\TNT DOCUMENT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/852-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1228-2-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1228-3-0x000000000044A09E-mapping.dmp
-
memory/1228-4-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1228-5-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB