Analysis
- max time kernel
67s - max time network
68s - platform
windows10_x64 - resource
win10 - submitted
05/10/2020, 11:44
General
- Target Turkistanman OCT order Swift 40 deposit against order PO 277138293.exe
- Size 658KB
- Sample201005-2lhdz5v6e2
- SHA256 b27e64df6a3791d23937cdc503aa9314770409a13dab6565b05570381cd71189
Malware Config
Extracted
-
Protocol
ftp
-
Host
ftp.universalinks.net
-
Port
21
-
Username
-
Password
{lafa{u^wEx8
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 2 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Turkistanman OCT order Swift 40 deposit against order PO 277138293.exe"C:\Users\Admin\AppData\Local\Temp\Turkistanman OCT order Swift 40 deposit against order PO 277138293.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Turkistanman OCT order Swift 40 deposit against order PO 277138293.exe"C:\Users\Admin\AppData\Local\Temp\Turkistanman OCT order Swift 40 deposit against order PO 277138293.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2544-10-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2544-19-0x0000000005530000-0x0000000005531000-memory.dmp
memory/2544-18-0x0000000005080000-0x0000000005081000-memory.dmp
memory/2544-13-0x0000000073D70000-0x000000007445E000-memory.dmp
memory/3892-4-0x00000000052C0000-0x00000000052C1000-memory.dmp
memory/3892-8-0x0000000006A80000-0x0000000006B01000-memory.dmp
memory/3892-9-0x0000000006B10000-0x0000000006B75000-memory.dmp
memory/3892-7-0x0000000005DB0000-0x00000000065B0000-memory.dmp
memory/3892-6-0x00000000052A0000-0x00000000052A1000-memory.dmp
memory/3892-5-0x0000000005450000-0x0000000005451000-memory.dmp
memory/3892-0-0x0000000073D70000-0x000000007445E000-memory.dmp
memory/3892-3-0x00000000058B0000-0x00000000058B1000-memory.dmp
memory/3892-1-0x00000000009D0000-0x00000000009D1000-memory.dmp