Analysis
- max time kernel
143s - max time network
102s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:48
Static task
static1
Behavioral task
behavioral1
Sample
Inv00911.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Inv00911.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target Inv00911.exe
- Size 1.5MB
- Sample201109-b49xp4ahfj
- SHA256 cff6792a6cccf7d929b62d65c62bbd99dfcb07698304804bdbddd86d4b39e3ae
- MD5 8e7cc0ebb8b7ec69caa3181df4fe0a52
- SHA1 41c726de4133b5382caa86767f049a60485c20d7
- SHA512 c53d06847732b36bb2dd0752f3c57456db79049c50bbd288b5e315247d506e0cab13fe6bfe4d461f8c15f122a5b8b04234f67c3e08455f67b64d1f8994168c64
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.chinagrill.co
-
Port
587
-
Username
-
Password
SnIVrXH!]f1q
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 2 IoCs
resource yara_rule behavioral2/memory/3200-1-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla behavioral2/memory/3200-2-0x000000000044B96E-mapping.dmp family_agenttesla - Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aadtb.url Inv00911.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1020 set thread context of 3200 1020 Inv00911.exe 78 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3200 MSBuild.exe 3200 MSBuild.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3200 MSBuild.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1020 Inv00911.exe 1020 Inv00911.exe 1020 Inv00911.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1020 wrote to memory of 3200 1020 Inv00911.exe 78 PID 1020 wrote to memory of 3200 1020 Inv00911.exe 78 PID 1020 wrote to memory of 3200 1020 Inv00911.exe 78 PID 1020 wrote to memory of 3200 1020 Inv00911.exe 78 PID 1020 wrote to memory of 3200 1020 Inv00911.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\Inv00911.exe"C:\Users\Admin\AppData\Local\Temp\Inv00911.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3200
-