Analysis
-
max time kernel
63s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 19:57
Behavioral task
behavioral1
Sample
fb36897fa9e0f60691b011aa1d48bce4.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
fb36897fa9e0f60691b011aa1d48bce4.exe
Resource
win10v20201028
General
-
Target
fb36897fa9e0f60691b011aa1d48bce4.exe
-
Size
522KB
-
MD5
fb36897fa9e0f60691b011aa1d48bce4
-
SHA1
41b88df0292611747097d824a9a75015397add79
-
SHA256
b2d092923decbb77dea424a3d430b58b1fd2b94a57f616a64a4ca7de1f721d27
-
SHA512
f42b6e2398e300734003f1e72a0c346358b2b5d4c72be3229e82d3e727edbfcbc1c3e66ab9a90b4665f7b9a4263cc5d04ce4c1da269040a336df54e01fd84642
Malware Config
Extracted
Protocol: smtp- Host:
mail.prudential.com.np - Port:
587 - Username:
damauli@prudential.com.np - Password:
ensure@prudential
Extracted
agenttesla
Protocol: smtp- Host:
mail.prudential.com.np - Port:
587 - Username:
damauli@prudential.com.np - Password:
ensure@prudential
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
Processes:
resource yara_rule behavioral2/memory/4704-6-0x0000000000A80000-0x0000000000A83000-memory.dmp coreentity -
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3300-11-0x0000000000400000-0x0000000000450000-memory.dmp family_agenttesla behavioral2/memory/3300-12-0x000000000044BCDE-mapping.dmp family_agenttesla -
Processes:
resource yara_rule behavioral2/memory/4704-7-0x000000000AA00000-0x000000000AA52000-memory.dmp rezer0 -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
fb36897fa9e0f60691b011aa1d48bce4.exedescription pid process target process PID 4704 set thread context of 3300 4704 fb36897fa9e0f60691b011aa1d48bce4.exe fb36897fa9e0f60691b011aa1d48bce4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
fb36897fa9e0f60691b011aa1d48bce4.exepid process 3300 fb36897fa9e0f60691b011aa1d48bce4.exe 3300 fb36897fa9e0f60691b011aa1d48bce4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
fb36897fa9e0f60691b011aa1d48bce4.exefb36897fa9e0f60691b011aa1d48bce4.exedescription pid process Token: SeDebugPrivilege 4704 fb36897fa9e0f60691b011aa1d48bce4.exe Token: SeDebugPrivilege 3300 fb36897fa9e0f60691b011aa1d48bce4.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
fb36897fa9e0f60691b011aa1d48bce4.exepid process 4704 fb36897fa9e0f60691b011aa1d48bce4.exe 4704 fb36897fa9e0f60691b011aa1d48bce4.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
fb36897fa9e0f60691b011aa1d48bce4.exedescription pid process target process PID 4704 wrote to memory of 2820 4704 fb36897fa9e0f60691b011aa1d48bce4.exe schtasks.exe PID 4704 wrote to memory of 2820 4704 fb36897fa9e0f60691b011aa1d48bce4.exe schtasks.exe PID 4704 wrote to memory of 2820 4704 fb36897fa9e0f60691b011aa1d48bce4.exe schtasks.exe PID 4704 wrote to memory of 3300 4704 fb36897fa9e0f60691b011aa1d48bce4.exe fb36897fa9e0f60691b011aa1d48bce4.exe PID 4704 wrote to memory of 3300 4704 fb36897fa9e0f60691b011aa1d48bce4.exe fb36897fa9e0f60691b011aa1d48bce4.exe PID 4704 wrote to memory of 3300 4704 fb36897fa9e0f60691b011aa1d48bce4.exe fb36897fa9e0f60691b011aa1d48bce4.exe PID 4704 wrote to memory of 3300 4704 fb36897fa9e0f60691b011aa1d48bce4.exe fb36897fa9e0f60691b011aa1d48bce4.exe PID 4704 wrote to memory of 3300 4704 fb36897fa9e0f60691b011aa1d48bce4.exe fb36897fa9e0f60691b011aa1d48bce4.exe PID 4704 wrote to memory of 3300 4704 fb36897fa9e0f60691b011aa1d48bce4.exe fb36897fa9e0f60691b011aa1d48bce4.exe PID 4704 wrote to memory of 3300 4704 fb36897fa9e0f60691b011aa1d48bce4.exe fb36897fa9e0f60691b011aa1d48bce4.exe PID 4704 wrote to memory of 3300 4704 fb36897fa9e0f60691b011aa1d48bce4.exe fb36897fa9e0f60691b011aa1d48bce4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb36897fa9e0f60691b011aa1d48bce4.exe"C:\Users\Admin\AppData\Local\Temp\fb36897fa9e0f60691b011aa1d48bce4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yDmRCoLfg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5951.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\fb36897fa9e0f60691b011aa1d48bce4.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fb36897fa9e0f60691b011aa1d48bce4.exe.logMD5
b4f7a6a57cb46d94b72410eb6a6d45a9
SHA169f3596ffa027202d391444b769ceea0ae14c5f7
SHA25623994ebe221a48ea16ebad51ae0d4b47ccd415ae10581f9405e588d4f6c2523b
SHA512be6da516e54c3a5b33ac2603137a2f8cf8445ff5961dd266faedf3627bae8979953d7ef305538df0151c609917a5b99bf5d023bdd32de50fd5c723950f90db5c
-
C:\Users\Admin\AppData\Local\Temp\tmp5951.tmpMD5
827a8c6b095ab732c695dbf989584547
SHA1a9271efd5ece319018b015dd51321839b171bb76
SHA256e015a8eb6600746a868473624a8747eec6056e48d4e96ca950a3a9e304c87e51
SHA51228f148cd85d423ec9525b054f52f5ffe57dd081abfe858bd5053c80f1f3dca1430abc33551b825c4585eefc794af37823ee1441f17a554438d66eda04de9a58e
-
memory/2820-9-0x0000000000000000-mapping.dmp
-
memory/3300-11-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/3300-20-0x0000000005CF0000-0x0000000005CF1000-memory.dmpFilesize
4KB
-
memory/3300-19-0x0000000005120000-0x0000000005121000-memory.dmpFilesize
4KB
-
memory/3300-14-0x0000000073FA0000-0x000000007468E000-memory.dmpFilesize
6.9MB
-
memory/3300-12-0x000000000044BCDE-mapping.dmp
-
memory/4704-3-0x00000000074D0000-0x00000000074D1000-memory.dmpFilesize
4KB
-
memory/4704-4-0x0000000007070000-0x0000000007071000-memory.dmpFilesize
4KB
-
memory/4704-0-0x0000000073FA0000-0x000000007468E000-memory.dmpFilesize
6.9MB
-
memory/4704-8-0x000000000A960000-0x000000000A961000-memory.dmpFilesize
4KB
-
memory/4704-1-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/4704-7-0x000000000AA00000-0x000000000AA52000-memory.dmpFilesize
328KB
-
memory/4704-6-0x0000000000A80000-0x0000000000A83000-memory.dmpFilesize
12KB
-
memory/4704-5-0x0000000002860000-0x0000000002861000-memory.dmpFilesize
4KB