Analysis
- max time kernel
141s - max time network
143s - platform
windows10_x64 - resource
win10 - submitted
20/08/2020, 13:32
Static task
static1
Behavioral task
behavioral1
Sample
files.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target files.exe
- Size 844KB
- Sample200820-7q9xa53glj
- SHA256 1328e0030337b326a962b3369cc8dd2b474de98267e8e9fdc3684f4e5ecb9984
- MD5 849f42939d0cca11d5e9e67cdcb117ba
- SHA1 7ffb8508c2e2523d4a07ec20cb7cc454d00feaf5
- SHA512 7704c7b3005b1558ebb3672e2cbcd97832006e4b32f91b244fbc2c18b617bda8a45f364522dd20d21c29a86f7f75f712ca7ec6c11a094f363c67b36e6546eec8
- MD5 SHA1 SHA512
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
daddyhandsome1234
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
resource yara_rule behavioral2/memory/4016-1-0x00000000004D7720-mapping.dmp agent_tesla behavioral2/memory/4016-4-0x0000000000400000-0x00000000004D9000-memory.dmp agent_tesla behavioral2/memory/4016-4-0x0000000000400000-0x00000000004D9000-memory.dmp agent_tesla behavioral2/memory/4016-5-0x00000000021D0000-0x0000000002236000-memory.dmp agent_tesla behavioral2/memory/4016-5-0x00000000021D0000-0x0000000002236000-memory.dmp agent_tesla -
resource yara_rule behavioral2/memory/4016-0-0x0000000000400000-0x00000000004D9000-memory.dmp upx behavioral2/memory/4016-0-0x0000000000400000-0x00000000004D9000-memory.dmp upx behavioral2/memory/4016-3-0x0000000000400000-0x00000000004D9000-memory.dmp upx behavioral2/memory/4016-3-0x0000000000400000-0x00000000004D9000-memory.dmp upx behavioral2/memory/4016-4-0x0000000000400000-0x00000000004D9000-memory.dmp upx behavioral2/memory/4016-4-0x0000000000400000-0x00000000004D9000-memory.dmp upx - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3900 set thread context of 4016 3900 files.exe 67 - Suspicious behavior: EnumeratesProcesses 228 IoCs
pid Process 3900 files.exe 3900 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 3604 files.exe 4016 files.exe 4016 files.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3900 files.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4016 files.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3900 wrote to memory of 4016 3900 files.exe 67 PID 3900 wrote to memory of 4016 3900 files.exe 67 PID 3900 wrote to memory of 4016 3900 files.exe 67 PID 3900 wrote to memory of 3604 3900 files.exe 68 PID 3900 wrote to memory of 3604 3900 files.exe 68 PID 3900 wrote to memory of 3604 3900 files.exe 68
Processes
-
C:\Users\Admin\AppData\Local\Temp\files.exe"C:\Users\Admin\AppData\Local\Temp\files.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\files.exe"C:\Users\Admin\AppData\Local\Temp\files.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
-
C:\Users\Admin\AppData\Local\Temp\files.exe"C:\Users\Admin\AppData\Local\Temp\files.exe" 2 4016 606092⤵
- Suspicious behavior: EnumeratesProcesses
PID:3604
-