Analysis
-
max time kernel
94s -
max time network
10s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:59
Static task
static1
Behavioral task
behavioral1
Sample
Daily report ~6 19 2020.exe
Resource
win7v20201028
General
-
Target
Daily report ~6 19 2020.exe
-
Size
445KB
-
MD5
82504ed1c2521b0c2f7b9cbb4865ab10
-
SHA1
55dc5ab4b73caa25952a1160193bf3e6e1e05898
-
SHA256
879b0b2d1e307c903d180f80ccf3c44f557c9c0cfa1d18854188c0660a3f8b17
-
SHA512
3bd891f8a28261bf9aaaf8791c319176024e100a39e7372cf2a899f9f38d816b3d8d7798ef4f820a883038a85bb81120f104d66e1efa9ede7afcd81f2af15343
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.epaindemgroup.com - Port:
587 - Username:
ekwe@epaindemgroup.com - Password:
}bf9e+EW5s$k
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1336-5-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1336-6-0x0000000000447E3E-mapping.dmp family_agenttesla behavioral1/memory/1336-7-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1336-8-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Processes:
resource yara_rule behavioral1/memory/364-4-0x0000000004310000-0x000000000435E000-memory.dmp rezer0 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Daily report ~6 19 2020.exedescription pid process target process PID 364 set thread context of 1336 364 Daily report ~6 19 2020.exe Daily report ~6 19 2020.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Daily report ~6 19 2020.exepid process 1336 Daily report ~6 19 2020.exe 1336 Daily report ~6 19 2020.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Daily report ~6 19 2020.exedescription pid process Token: SeDebugPrivilege 1336 Daily report ~6 19 2020.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Daily report ~6 19 2020.exepid process 1336 Daily report ~6 19 2020.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Daily report ~6 19 2020.exedescription pid process target process PID 364 wrote to memory of 1336 364 Daily report ~6 19 2020.exe Daily report ~6 19 2020.exe PID 364 wrote to memory of 1336 364 Daily report ~6 19 2020.exe Daily report ~6 19 2020.exe PID 364 wrote to memory of 1336 364 Daily report ~6 19 2020.exe Daily report ~6 19 2020.exe PID 364 wrote to memory of 1336 364 Daily report ~6 19 2020.exe Daily report ~6 19 2020.exe PID 364 wrote to memory of 1336 364 Daily report ~6 19 2020.exe Daily report ~6 19 2020.exe PID 364 wrote to memory of 1336 364 Daily report ~6 19 2020.exe Daily report ~6 19 2020.exe PID 364 wrote to memory of 1336 364 Daily report ~6 19 2020.exe Daily report ~6 19 2020.exe PID 364 wrote to memory of 1336 364 Daily report ~6 19 2020.exe Daily report ~6 19 2020.exe PID 364 wrote to memory of 1336 364 Daily report ~6 19 2020.exe Daily report ~6 19 2020.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Daily report ~6 19 2020.exe"C:\Users\Admin\AppData\Local\Temp\Daily report ~6 19 2020.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Daily report ~6 19 2020.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/364-0-0x0000000073F40000-0x000000007462E000-memory.dmpFilesize
6.9MB
-
memory/364-1-0x0000000000E90000-0x0000000000E91000-memory.dmpFilesize
4KB
-
memory/364-3-0x0000000000280000-0x000000000028F000-memory.dmpFilesize
60KB
-
memory/364-4-0x0000000004310000-0x000000000435E000-memory.dmpFilesize
312KB
-
memory/1336-5-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1336-6-0x0000000000447E3E-mapping.dmp
-
memory/1336-7-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1336-8-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1336-9-0x0000000073EC0000-0x00000000745AE000-memory.dmpFilesize
6.9MB