Analysis
- max time kernel
142s - max time network
113s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:14
Static task
static1
Behavioral task
behavioral1
Sample
Paid.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target Paid.exe
- Size 1.5MB
- Sample201109-fyb3te9yes
- SHA256 e9fc4844ee50f9e59616bd7238bfae3de6b8b194abf635e787e5a44d8658fe42
- MD5 42eb50b9b2cf1c267d43a6ce6cb6c6c6
- SHA1 e8ad3705a4f5a721aa191f3e1c5a1e8ea63e36d4
- SHA512 18b9305723fd4e5487b29493376a5b3f3db61bdedbd2d853c37d8712926dff21fb0a158d476a333f72492354bcd530adb4e5581757685c52cbfd89aaa0c08558
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
business40.web-hosting.com
-
Port
587
-
Username
-
Password
Itiswell1@
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 13 IoCs
resource yara_rule behavioral2/memory/3896-0-0x0000000000150000-0x00000000001A0000-memory.dmp family_agenttesla behavioral2/memory/3896-1-0x000000000019BA4E-mapping.dmp family_agenttesla behavioral2/memory/3896-10-0x000000000019BA4E-mapping.dmp family_agenttesla behavioral2/memory/3896-11-0x000000000019BA4E-mapping.dmp family_agenttesla behavioral2/memory/3896-12-0x000000000019BA4E-mapping.dmp family_agenttesla behavioral2/memory/3896-13-0x000000000019BA4E-mapping.dmp family_agenttesla behavioral2/memory/3896-15-0x000000000019BA4E-mapping.dmp family_agenttesla behavioral2/memory/3896-19-0x000000000019BA4E-mapping.dmp family_agenttesla behavioral2/memory/3896-20-0x000000000019BA4E-mapping.dmp family_agenttesla behavioral2/memory/3896-18-0x000000000019BA4E-mapping.dmp family_agenttesla behavioral2/memory/3896-17-0x000000000019BA4E-mapping.dmp family_agenttesla behavioral2/memory/3896-16-0x000000000019BA4E-mapping.dmp family_agenttesla behavioral2/memory/3896-14-0x000000000019BA4E-mapping.dmp family_agenttesla - Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\igfxHK.url Paid.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4696 set thread context of 3896 4696 Paid.exe 78 - Program crash 1 IoCs
pid pid_target Process procid_target 1356 3896 WerFault.exe 78 - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 3896 MSBuild.exe 3896 MSBuild.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3896 MSBuild.exe Token: SeRestorePrivilege 1356 WerFault.exe Token: SeBackupPrivilege 1356 WerFault.exe Token: SeDebugPrivilege 1356 WerFault.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4696 Paid.exe 4696 Paid.exe 4696 Paid.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4696 wrote to memory of 3896 4696 Paid.exe 78 PID 4696 wrote to memory of 3896 4696 Paid.exe 78 PID 4696 wrote to memory of 3896 4696 Paid.exe 78 PID 4696 wrote to memory of 3896 4696 Paid.exe 78 PID 4696 wrote to memory of 3896 4696 Paid.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\Paid.exe"C:\Users\Admin\AppData\Local\Temp\Paid.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3896 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 14283⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1356
-
-