Analysis
- max time kernel
95s - max time network
151s - platform
windows10_x64 - resource
win10 - submitted
19/10/2020, 11:03
General
- Target 046671828bd29a5f7c640ac2ee36b304.exe
- Size 1.1MB
- Sample201019-c38wnbbh36
- SHA256 aa703ba4b6b97339a2d84fca6c433da3118f4930ffd27d7bd401a82d7a722e29
Malware Config
Extracted
-
Protocol
smtp
-
Host
bh-58.webhostbox.net
-
Port
587
-
Username
-
Password
7213575aceACE@#$
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 1 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\046671828bd29a5f7c640ac2ee36b304.exe"C:\Users\Admin\AppData\Local\Temp\046671828bd29a5f7c640ac2ee36b304.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chrone\chrone.exe"'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1788-13-0x00000000076C0000-0x00000000076C1000-memory.dmp
memory/1788-31-0x00000000092F0000-0x00000000092F1000-memory.dmp
memory/1788-33-0x00000000092E0000-0x00000000092E1000-memory.dmp
memory/1788-14-0x0000000007730000-0x0000000007731000-memory.dmp
memory/1788-30-0x0000000009340000-0x0000000009341000-memory.dmp
memory/1788-6-0x0000000073BA0000-0x000000007428E000-memory.dmp
memory/1788-8-0x00000000045B0000-0x00000000045B1000-memory.dmp
memory/1788-9-0x0000000007090000-0x0000000007091000-memory.dmp
memory/1788-29-0x0000000009080000-0x0000000009081000-memory.dmp
memory/1788-11-0x0000000006FE0000-0x0000000006FE1000-memory.dmp
memory/1788-28-0x0000000009020000-0x0000000009021000-memory.dmp
memory/1788-15-0x00000000079E0000-0x00000000079E1000-memory.dmp
memory/1788-19-0x00000000080D0000-0x00000000080D1000-memory.dmp
memory/1788-21-0x0000000009040000-0x0000000009073000-memory.dmp
memory/1788-17-0x0000000007910000-0x0000000007911000-memory.dmp
memory/1788-18-0x0000000008290000-0x0000000008291000-memory.dmp
memory/3748-0-0x0000000073BA0000-0x000000007428E000-memory.dmp
memory/3748-1-0x0000000000B10000-0x0000000000B11000-memory.dmp
memory/3748-12-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/3748-10-0x0000000005B10000-0x0000000005B11000-memory.dmp
memory/3748-7-0x0000000006240000-0x0000000006241000-memory.dmp
memory/3748-5-0x0000000005790000-0x00000000057F0000-memory.dmp
memory/3748-3-0x0000000005600000-0x0000000005648000-memory.dmp
memory/3748-35-0x0000000006D50000-0x0000000006D51000-memory.dmp
memory/3748-36-0x0000000006CC0000-0x0000000006CC1000-memory.dmp