Analysis
- max time kernel
151s - max time network
18s - platform
windows7_x64 - resource
win7 - submitted
12/10/2020, 18:59
Static task
static1
Behavioral task
behavioral1
Sample
642e9540fdb40b32b9400c015ab9de7f.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
642e9540fdb40b32b9400c015ab9de7f.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target 642e9540fdb40b32b9400c015ab9de7f.exe
- Size 965KB
- Sample201012-japltw9s2e
- SHA256 7ed42f7ef1538a1e13b685f37ed0b2995fdd7151af2a5ae97c68112bb244ef8d
- MD5 642e9540fdb40b32b9400c015ab9de7f
- SHA1 be59e758877ff808e461807b156008cef670ebf1
- SHA512 51d3d1213a9b28ed6ec68e73e95db499626173d009eb3b1e54d0489da72a647a9b8f5129a05d10106f02e39082b60b773103a0d130b437a024e650a403dea6c7
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
us2.smtp.mailhostbox.com
-
Port
587
-
Username
-
Password
OSINACHI3116
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 5 IoCs
resource yara_rule behavioral1/memory/1620-5-0x0000000000400000-0x0000000000466000-memory.dmp family_agenttesla behavioral1/memory/1620-6-0x0000000000461C0E-mapping.dmp family_agenttesla behavioral1/memory/1620-7-0x0000000000400000-0x0000000000466000-memory.dmp family_agenttesla behavioral1/memory/1620-8-0x0000000000400000-0x0000000000466000-memory.dmp family_agenttesla behavioral1/memory/2040-19-0x0000000000461C0E-mapping.dmp family_agenttesla - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1124 set thread context of 1620 1124 642e9540fdb40b32b9400c015ab9de7f.exe 28 PID 1912 set thread context of 2040 1912 642e9540fdb40b32b9400c015ab9de7f.exe 31 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1620 RegAsm.exe 1620 RegAsm.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1912 642e9540fdb40b32b9400c015ab9de7f.exe 1912 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1912 642e9540fdb40b32b9400c015ab9de7f.exe 1912 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 2040 RegAsm.exe 2040 RegAsm.exe 1912 642e9540fdb40b32b9400c015ab9de7f.exe 1912 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1912 642e9540fdb40b32b9400c015ab9de7f.exe 1912 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1912 642e9540fdb40b32b9400c015ab9de7f.exe 1912 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1912 642e9540fdb40b32b9400c015ab9de7f.exe 1912 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1912 642e9540fdb40b32b9400c015ab9de7f.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1124 642e9540fdb40b32b9400c015ab9de7f.exe 1912 642e9540fdb40b32b9400c015ab9de7f.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1124 642e9540fdb40b32b9400c015ab9de7f.exe Token: SeDebugPrivilege 1620 RegAsm.exe Token: SeDebugPrivilege 1912 642e9540fdb40b32b9400c015ab9de7f.exe Token: SeDebugPrivilege 2040 RegAsm.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1124 wrote to memory of 1620 1124 642e9540fdb40b32b9400c015ab9de7f.exe 28 PID 1124 wrote to memory of 1620 1124 642e9540fdb40b32b9400c015ab9de7f.exe 28 PID 1124 wrote to memory of 1620 1124 642e9540fdb40b32b9400c015ab9de7f.exe 28 PID 1124 wrote to memory of 1620 1124 642e9540fdb40b32b9400c015ab9de7f.exe 28 PID 1124 wrote to memory of 1620 1124 642e9540fdb40b32b9400c015ab9de7f.exe 28 PID 1124 wrote to memory of 1620 1124 642e9540fdb40b32b9400c015ab9de7f.exe 28 PID 1124 wrote to memory of 1620 1124 642e9540fdb40b32b9400c015ab9de7f.exe 28 PID 1124 wrote to memory of 1620 1124 642e9540fdb40b32b9400c015ab9de7f.exe 28 PID 1124 wrote to memory of 1912 1124 642e9540fdb40b32b9400c015ab9de7f.exe 29 PID 1124 wrote to memory of 1912 1124 642e9540fdb40b32b9400c015ab9de7f.exe 29 PID 1124 wrote to memory of 1912 1124 642e9540fdb40b32b9400c015ab9de7f.exe 29 PID 1124 wrote to memory of 1912 1124 642e9540fdb40b32b9400c015ab9de7f.exe 29 PID 1912 wrote to memory of 2040 1912 642e9540fdb40b32b9400c015ab9de7f.exe 31 PID 1912 wrote to memory of 2040 1912 642e9540fdb40b32b9400c015ab9de7f.exe 31 PID 1912 wrote to memory of 2040 1912 642e9540fdb40b32b9400c015ab9de7f.exe 31 PID 1912 wrote to memory of 2040 1912 642e9540fdb40b32b9400c015ab9de7f.exe 31 PID 1912 wrote to memory of 2040 1912 642e9540fdb40b32b9400c015ab9de7f.exe 31 PID 1912 wrote to memory of 2040 1912 642e9540fdb40b32b9400c015ab9de7f.exe 31 PID 1912 wrote to memory of 2040 1912 642e9540fdb40b32b9400c015ab9de7f.exe 31 PID 1912 wrote to memory of 2040 1912 642e9540fdb40b32b9400c015ab9de7f.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\642e9540fdb40b32b9400c015ab9de7f.exe"C:\Users\Admin\AppData\Local\Temp\642e9540fdb40b32b9400c015ab9de7f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
C:\Users\Admin\AppData\Local\Temp\642e9540fdb40b32b9400c015ab9de7f.exe"C:\Users\Admin\AppData\Local\Temp\642e9540fdb40b32b9400c015ab9de7f.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2040
-
-