Analysis
- max time kernel
138s - max time network
146s - platform
windows10_x64 - resource
win10v200722 - submitted
12/08/2020, 14:38
General
- Target Shipment Invoice.jpg.jpg.jpg.jpg.scr
- Size 96KB
- Sample200812-bfjht4pyks
- SHA256 545bc37874b09c18f4fcef578eb3f9f3d47673255bbc32bc41986fc4e71f896f
Score
10/10
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipment Invoice.jpg.jpg.jpg.jpg.scr"C:\Users\Admin\AppData\Local\Temp\Shipment Invoice.jpg.jpg.jpg.jpg.scr" /S1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\Shipment Invoice.jpg.jpg.jpg.jpg.scr" /S2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/500-3-0x0000000071B40000-0x000000007222E000-memory.dmp
memory/500-4-0x0000000000400000-0x0000000000401000-memory.dmp
memory/500-6-0x0000000021060000-0x0000000021061000-memory.dmp
memory/500-7-0x00000000209C0000-0x00000000209C1000-memory.dmp
memory/500-8-0x0000000000F30000-0x0000000000F31000-memory.dmp
memory/500-9-0x0000000020A60000-0x0000000020A61000-memory.dmp
memory/500-10-0x000000001DFC0000-0x000000001DFC1000-memory.dmp
memory/500-11-0x000000001DF90000-0x000000001DF91000-memory.dmp