Analysis
- max time kernel
144s - max time network
118s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:54
Static task
static1
Behavioral task
behavioral1
Sample
Enquiry.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Enquiry.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target Enquiry.exe
- Size 1.9MB
- Sample201109-j4qtvdvmvs
- SHA256 ded450af998de45b6a1ac415f262e047e7bd173b152e61d2cbe26877ddafe706
- MD5 135d8d4f91a864a8f26105d4b760f5cf
- SHA1 b12ce8091abd9127a0a7c6c2407f6649867a68fb
- SHA512 555a4ac49f49bfff68700d9e3303c64901628c1af032943a569faa4c1e50bf37e3150b63a39db830ffbea6483e92b5b93d69162296da689f2db6d6071b936b9f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
mail.dormakeba.com
-
Port
587
-
Username
-
Password
]b!JtPxUT=)T
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 2 IoCs
resource yara_rule behavioral2/memory/2808-0-0x0000000000400000-0x000000000044E000-memory.dmp family_agenttesla behavioral2/memory/2808-1-0x000000000044953E-mapping.dmp family_agenttesla - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3932 set thread context of 2808 3932 Enquiry.exe 75 - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2808 MSBuild.exe 2808 MSBuild.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2808 MSBuild.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3932 Enquiry.exe 3932 Enquiry.exe 3932 Enquiry.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3932 wrote to memory of 2808 3932 Enquiry.exe 75 PID 3932 wrote to memory of 2808 3932 Enquiry.exe 75 PID 3932 wrote to memory of 2808 3932 Enquiry.exe 75 PID 3932 wrote to memory of 2808 3932 Enquiry.exe 75 PID 3932 wrote to memory of 2808 3932 Enquiry.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\Enquiry.exe"C:\Users\Admin\AppData\Local\Temp\Enquiry.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808
-