Analysis
- max time kernel
115s - max time network
120s - platform
windows7_x64 - resource
win7 - submitted
04/08/2020, 06:27
Static task
static1
Behavioral task
behavioral1
Sample
ABB RFQ SC0054852_PDF.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ABB RFQ SC0054852_PDF.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target ABB RFQ SC0054852_PDF.exe
- Size 596KB
- Sample200804-sae1vm177n
- SHA256 6edf56bf042ac4f2cf12f3dcdd5704e71ddeee943463706513ba51123209bc6f
- MD5 679962363c527fb1c84fe0c8158d038a
- SHA1 a4ef44cf1f7bffd657770d13e0390f3543bab9a0
- SHA512 d7721492f8ee377724aacfd480a4414c343e22271f554956d1c82902779f818946006871b8a84d3100a5aeea403f36e1c9fdf2da81b2dce6c8aa5ed307e9273f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.urban.co.th
-
Port
587
-
Username
-
Password
Urban@1143
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 4 IoCs
resource yara_rule behavioral1/memory/784-2-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/784-3-0x000000000044707E-mapping.dmp family_agenttesla behavioral1/memory/784-4-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/784-5-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 608 set thread context of 784 608 ABB RFQ SC0054852_PDF.exe 26 - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 608 ABB RFQ SC0054852_PDF.exe 608 ABB RFQ SC0054852_PDF.exe 784 RegSvcs.exe 784 RegSvcs.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 608 ABB RFQ SC0054852_PDF.exe Token: SeDebugPrivilege 784 RegSvcs.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 784 RegSvcs.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 608 wrote to memory of 876 608 ABB RFQ SC0054852_PDF.exe 24 PID 608 wrote to memory of 876 608 ABB RFQ SC0054852_PDF.exe 24 PID 608 wrote to memory of 876 608 ABB RFQ SC0054852_PDF.exe 24 PID 608 wrote to memory of 876 608 ABB RFQ SC0054852_PDF.exe 24 PID 608 wrote to memory of 876 608 ABB RFQ SC0054852_PDF.exe 24 PID 608 wrote to memory of 876 608 ABB RFQ SC0054852_PDF.exe 24 PID 608 wrote to memory of 876 608 ABB RFQ SC0054852_PDF.exe 24 PID 608 wrote to memory of 340 608 ABB RFQ SC0054852_PDF.exe 25 PID 608 wrote to memory of 340 608 ABB RFQ SC0054852_PDF.exe 25 PID 608 wrote to memory of 340 608 ABB RFQ SC0054852_PDF.exe 25 PID 608 wrote to memory of 340 608 ABB RFQ SC0054852_PDF.exe 25 PID 608 wrote to memory of 340 608 ABB RFQ SC0054852_PDF.exe 25 PID 608 wrote to memory of 340 608 ABB RFQ SC0054852_PDF.exe 25 PID 608 wrote to memory of 340 608 ABB RFQ SC0054852_PDF.exe 25 PID 608 wrote to memory of 784 608 ABB RFQ SC0054852_PDF.exe 26 PID 608 wrote to memory of 784 608 ABB RFQ SC0054852_PDF.exe 26 PID 608 wrote to memory of 784 608 ABB RFQ SC0054852_PDF.exe 26 PID 608 wrote to memory of 784 608 ABB RFQ SC0054852_PDF.exe 26 PID 608 wrote to memory of 784 608 ABB RFQ SC0054852_PDF.exe 26 PID 608 wrote to memory of 784 608 ABB RFQ SC0054852_PDF.exe 26 PID 608 wrote to memory of 784 608 ABB RFQ SC0054852_PDF.exe 26 PID 608 wrote to memory of 784 608 ABB RFQ SC0054852_PDF.exe 26 PID 608 wrote to memory of 784 608 ABB RFQ SC0054852_PDF.exe 26 PID 608 wrote to memory of 784 608 ABB RFQ SC0054852_PDF.exe 26 PID 608 wrote to memory of 784 608 ABB RFQ SC0054852_PDF.exe 26 PID 608 wrote to memory of 784 608 ABB RFQ SC0054852_PDF.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\ABB RFQ SC0054852_PDF.exe"C:\Users\Admin\AppData\Local\Temp\ABB RFQ SC0054852_PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:876
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:340
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:784
-