Analysis
- max time kernel
146s - max time network
104s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:39
Static task
static1
Behavioral task
behavioral1
Sample
5a.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5a.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 5a.exe
- Size 1.7MB
- Sample201109-kvmffartwx
- SHA256 e0f4d5681c4d19ec5ea23db306f6956889ab939a392113ad631a31bdcbd57d21
- MD5 24739fb9e71cabc65cc2bca23e1b6b76
- SHA1 2adc979c14551682920d4126252d666774be031e
- SHA512 6fc41e7fa2e958089e720a6741ea68e360801ad5ff91d59f9ec7341aec95e55671a9cea2089eb0f3349fc8b854d4ca522dd6558c751e3c302a4a74b78f87ff55
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
smtp.hazelsystems.co.in
-
Port
587
-
Username
-
Password
hazel1995
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 17 IoCs
resource yara_rule behavioral2/memory/1940-0-0x0000000000400000-0x000000000044E000-memory.dmp family_agenttesla behavioral2/memory/1940-1-0x00000000004499EE-mapping.dmp family_agenttesla behavioral2/memory/1940-10-0x00000000004499EE-mapping.dmp family_agenttesla behavioral2/memory/1940-11-0x00000000004499EE-mapping.dmp family_agenttesla behavioral2/memory/1940-12-0x00000000004499EE-mapping.dmp family_agenttesla behavioral2/memory/1940-15-0x00000000004499EE-mapping.dmp family_agenttesla behavioral2/memory/1940-16-0x00000000004499EE-mapping.dmp family_agenttesla behavioral2/memory/1940-14-0x00000000004499EE-mapping.dmp family_agenttesla behavioral2/memory/1940-13-0x00000000004499EE-mapping.dmp family_agenttesla behavioral2/memory/1940-17-0x00000000004499EE-mapping.dmp family_agenttesla behavioral2/memory/1940-18-0x00000000004499EE-mapping.dmp family_agenttesla behavioral2/memory/1940-19-0x00000000004499EE-mapping.dmp family_agenttesla behavioral2/memory/1940-24-0x00000000004499EE-mapping.dmp family_agenttesla behavioral2/memory/1940-23-0x00000000004499EE-mapping.dmp family_agenttesla behavioral2/memory/1940-22-0x00000000004499EE-mapping.dmp family_agenttesla behavioral2/memory/1940-21-0x00000000004499EE-mapping.dmp family_agenttesla behavioral2/memory/1940-20-0x00000000004499EE-mapping.dmp family_agenttesla - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1036 set thread context of 1940 1036 5a.exe 79 - Program crash 1 IoCs
pid pid_target Process procid_target 1308 1940 WerFault.exe 79 - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 1940 MSBuild.exe 1940 MSBuild.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1308 WerFault.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe 1036 5a.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1036 5a.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1940 MSBuild.exe Token: SeRestorePrivilege 1308 WerFault.exe Token: SeBackupPrivilege 1308 WerFault.exe Token: SeDebugPrivilege 1308 WerFault.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1036 5a.exe 1036 5a.exe 1036 5a.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1036 5a.exe 1036 5a.exe 1036 5a.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1036 wrote to memory of 1940 1036 5a.exe 79 PID 1036 wrote to memory of 1940 1036 5a.exe 79 PID 1036 wrote to memory of 1940 1036 5a.exe 79 PID 1036 wrote to memory of 1940 1036 5a.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a.exe"C:\Users\Admin\AppData\Local\Temp\5a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1940 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 14563⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
-