Analysis
- max time kernel
77s - max time network
144s - platform
windows10_x64 - resource
win10v200722 - submitted
14/08/2020, 08:11
Static task
static1
Behavioral task
behavioral1
Sample
shedy.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target shedy.exe
- Size 799KB
- Sample200814-kk8yerwxfe
- SHA256 659cae123fddea653c5ca19e452e809bedb01e283b442dff20f0f5e674a35b1c
- MD5 5277d5a5515ef72c426b650ede2c95f8
- SHA1 a5deea5c7f3908a7b4e4e7edeea8675796c8bb5c
- SHA512 09223e135cc73fcb4558d4257e5e51c3af278ec5f1b38a9c3f2a26d1daf40606296e782d5919510a9d80bb4e00a837e6dc07473d2eebd390e153b8618ee92204
- MD5 SHA1 SHA512
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
mail.myvfxpro.com
-
Port
587
-
Username
-
Password
N)ZB+ym2x5QD
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
resource yara_rule behavioral2/memory/1180-1-0x000000000049FEF0-mapping.dmp agent_tesla behavioral2/memory/1180-4-0x0000000000400000-0x00000000004A2000-memory.dmp agent_tesla behavioral2/memory/1180-4-0x0000000000400000-0x00000000004A2000-memory.dmp agent_tesla behavioral2/memory/1180-5-0x00000000009E0000-0x0000000000A2A000-memory.dmp agent_tesla behavioral2/memory/1180-5-0x00000000009E0000-0x0000000000A2A000-memory.dmp agent_tesla -
resource yara_rule behavioral2/memory/1180-0-0x0000000000400000-0x00000000004A2000-memory.dmp upx behavioral2/memory/1180-0-0x0000000000400000-0x00000000004A2000-memory.dmp upx behavioral2/memory/1180-3-0x0000000000400000-0x00000000004A2000-memory.dmp upx behavioral2/memory/1180-3-0x0000000000400000-0x00000000004A2000-memory.dmp upx behavioral2/memory/1180-4-0x0000000000400000-0x00000000004A2000-memory.dmp upx behavioral2/memory/1180-4-0x0000000000400000-0x00000000004A2000-memory.dmp upx - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1052 set thread context of 1180 1052 shedy.exe 67 - Suspicious behavior: EnumeratesProcesses 236 IoCs
pid Process 1052 shedy.exe 1052 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1300 shedy.exe 1180 shedy.exe 1180 shedy.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1052 shedy.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1180 shedy.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1052 wrote to memory of 1180 1052 shedy.exe 67 PID 1052 wrote to memory of 1180 1052 shedy.exe 67 PID 1052 wrote to memory of 1180 1052 shedy.exe 67 PID 1052 wrote to memory of 1300 1052 shedy.exe 68 PID 1052 wrote to memory of 1300 1052 shedy.exe 68 PID 1052 wrote to memory of 1300 1052 shedy.exe 68
Processes
-
C:\Users\Admin\AppData\Local\Temp\shedy.exe"C:\Users\Admin\AppData\Local\Temp\shedy.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\shedy.exe"C:\Users\Admin\AppData\Local\Temp\shedy.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-
C:\Users\Admin\AppData\Local\Temp\shedy.exe"C:\Users\Admin\AppData\Local\Temp\shedy.exe" 2 1180 833432⤵
- Suspicious behavior: EnumeratesProcesses
PID:1300
-