Analysis
- max time kernel
126s - max time network
126s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:57
General
- Target REMITTANCE.exe
- Size 468KB
- Sample201109-98rn25h892
- SHA256 044f346090955fbda34aa50d2a670296ac175e76993ee9abc3ea2618b0a9cec0
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
us2.smtp.mailhostbox.com
-
Port
587
-
Username
-
Password
!c}w0m3nCK#h
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
- AgentTesla Payload 2 IoCs
- rezer0 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\REMITTANCE.exe"C:\Users\Admin\AppData\Local\Temp\REMITTANCE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REMITTANCE.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/636-7-0x0000000005460000-0x0000000005462000-memory.dmp
memory/636-8-0x0000000008B80000-0x0000000008BD3000-memory.dmp
memory/636-3-0x0000000005470000-0x0000000005471000-memory.dmp
memory/636-4-0x0000000004E70000-0x0000000004E71000-memory.dmp
memory/636-5-0x0000000004E60000-0x0000000004E61000-memory.dmp
memory/636-6-0x0000000008A30000-0x0000000008A31000-memory.dmp
memory/636-0-0x0000000073E00000-0x00000000744EE000-memory.dmp
memory/636-1-0x00000000005A0000-0x00000000005A1000-memory.dmp
memory/3848-17-0x0000000005A40000-0x0000000005A41000-memory.dmp
memory/3848-11-0x0000000073E00000-0x00000000744EE000-memory.dmp
memory/3848-16-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/3848-9-0x0000000000400000-0x0000000000452000-memory.dmp