Analysis
- max time kernel
145s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:40
Static task
static1
Behavioral task
behavioral1
Sample
Quotation & Sample.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Quotation & Sample.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target Quotation & Sample.exe
- Size 1.4MB
- Sample201109-jm6whbbzca
- SHA256 9dc77917857b09b06426f7637f10582c8564327f900a7a8f3b6c386ab3ef13a8
- MD5 59b1bc4c6f333033faa3355015b984f0
- SHA1 901a180731f72ea1075258e296f3ed0ac2ceac67
- SHA512 7c0907aac7da87c70521888b9d259172570861158b5f75fb0aef9ac6706ee258b6f1c3bd2cccad0c3f873e516b19d273c93a29464fc956b47f217152fb3124ba
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
us2.smtp.mailhostbox.com
-
Port
587
-
Username
-
Password
anyanwu3116
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 2 IoCs
resource yara_rule behavioral2/memory/3784-1-0x0000000000610000-0x0000000000662000-memory.dmp family_agenttesla behavioral2/memory/3784-2-0x000000000065CE4E-mapping.dmp family_agenttesla - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 828 set thread context of 3784 828 Quotation & Sample.exe 75 - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 3784 MSBuild.exe 3784 MSBuild.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3784 MSBuild.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 828 Quotation & Sample.exe 828 Quotation & Sample.exe 828 Quotation & Sample.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 828 wrote to memory of 3784 828 Quotation & Sample.exe 75 PID 828 wrote to memory of 3784 828 Quotation & Sample.exe 75 PID 828 wrote to memory of 3784 828 Quotation & Sample.exe 75 PID 828 wrote to memory of 3784 828 Quotation & Sample.exe 75 PID 828 wrote to memory of 3784 828 Quotation & Sample.exe 75 PID 3784 wrote to memory of 2284 3784 MSBuild.exe 79 PID 3784 wrote to memory of 2284 3784 MSBuild.exe 79 PID 3784 wrote to memory of 2284 3784 MSBuild.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation & Sample.exe"C:\Users\Admin\AppData\Local\Temp\Quotation & Sample.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵PID:2284
-
-