Analysis
- max time kernel
148s - max time network
111s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:40
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe
- Size 1.4MB
- Sample201109-bteqkl1fej
- SHA256 07b55ae89038136fc1da21d2aaea7b9e6d17ea18843d26f9bbcad7124eb5f1be
- MD5 2fc3fdaeda173710cb9a6bb5e8a993d8
- SHA1 2032c807e034d5e87ddfcd80e1b54d01e9d52684
- SHA512 1663370a176e6b7ecbf0786504f7069d2b4d03fe0b40c73b2616c45671f748a9b6ac3d7da9584d0bb67f78d4f9af52ba3a66931792086fdace393ac1df2de2e3
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 16 IoCs
resource yara_rule behavioral2/memory/752-0-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral2/memory/752-1-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/752-11-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/752-12-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/752-14-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/752-13-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/752-15-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/752-16-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/752-17-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/752-19-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/752-20-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/752-18-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/752-21-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/752-22-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/752-23-0x000000000044C93E-mapping.dmp family_agenttesla behavioral2/memory/752-24-0x000000000044C93E-mapping.dmp family_agenttesla - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 576 set thread context of 752 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 75 - Program crash 1 IoCs
pid pid_target Process procid_target 636 752 WerFault.exe 75 - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 752 MSBuild.exe 752 MSBuild.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 636 WerFault.exe 636 WerFault.exe 636 WerFault.exe 636 WerFault.exe 636 WerFault.exe 636 WerFault.exe 636 WerFault.exe 636 WerFault.exe 636 WerFault.exe 636 WerFault.exe 636 WerFault.exe 636 WerFault.exe 636 WerFault.exe 636 WerFault.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 752 MSBuild.exe Token: SeRestorePrivilege 636 WerFault.exe Token: SeBackupPrivilege 636 WerFault.exe Token: SeDebugPrivilege 636 WerFault.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 576 wrote to memory of 752 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 75 PID 576 wrote to memory of 752 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 75 PID 576 wrote to memory of 752 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 75 PID 576 wrote to memory of 752 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 75 PID 576 wrote to memory of 752 576 SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe 75 PID 752 wrote to memory of 500 752 MSBuild.exe 79 PID 752 wrote to memory of 500 752 MSBuild.exe 79 PID 752 wrote to memory of 500 752 MSBuild.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT_COPY_FOR URGENT_RESPOSNSE_sw356388838.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵PID:500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 15443⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:636
-
-