Analysis
- max time kernel
144s - max time network
128s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:32
Static task
static1
Behavioral task
behavioral1
Sample
481b568abda95328ae140f840ce4b0ec.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
481b568abda95328ae140f840ce4b0ec.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 481b568abda95328ae140f840ce4b0ec.exe
- Size 1.4MB
- Sample201109-ll6nkfvst2
- SHA256 7be3a3d6b712edfa50d8d5a443b5bd7719d57c9be6b7d34ebe2e3e4a7815e062
- MD5 481b568abda95328ae140f840ce4b0ec
- SHA1 bcbeee647fcc9d71a0bb5dc9c1e015d19c9f3aad
- SHA512 7075f19297931647c60fc63710d6b0b593ac1773de63f5bab8f5d49f2e64200e29f2cff0da08187f825c7a811ea2b22a662420646a547056aba7d2f5c5813278
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 13 IoCs
resource yara_rule behavioral2/memory/3556-0-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral2/memory/3556-1-0x000000000044C89E-mapping.dmp family_agenttesla behavioral2/memory/3556-10-0x000000000044C89E-mapping.dmp family_agenttesla behavioral2/memory/3556-11-0x000000000044C89E-mapping.dmp family_agenttesla behavioral2/memory/3556-12-0x000000000044C89E-mapping.dmp family_agenttesla behavioral2/memory/3556-14-0x000000000044C89E-mapping.dmp family_agenttesla behavioral2/memory/3556-13-0x000000000044C89E-mapping.dmp family_agenttesla behavioral2/memory/3556-15-0x000000000044C89E-mapping.dmp family_agenttesla behavioral2/memory/3556-16-0x000000000044C89E-mapping.dmp family_agenttesla behavioral2/memory/3556-17-0x000000000044C89E-mapping.dmp family_agenttesla behavioral2/memory/3556-18-0x000000000044C89E-mapping.dmp family_agenttesla behavioral2/memory/3556-19-0x000000000044C89E-mapping.dmp family_agenttesla behavioral2/memory/3556-20-0x000000000044C89E-mapping.dmp family_agenttesla - Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\grpconv.url 481b568abda95328ae140f840ce4b0ec.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1400 set thread context of 3556 1400 481b568abda95328ae140f840ce4b0ec.exe 76 - Program crash 1 IoCs
pid pid_target Process procid_target 3784 3556 WerFault.exe 76 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3556 MSBuild.exe 3556 MSBuild.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3556 MSBuild.exe Token: SeRestorePrivilege 3784 WerFault.exe Token: SeBackupPrivilege 3784 WerFault.exe Token: SeDebugPrivilege 3784 WerFault.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe 1400 481b568abda95328ae140f840ce4b0ec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1400 wrote to memory of 3556 1400 481b568abda95328ae140f840ce4b0ec.exe 76 PID 1400 wrote to memory of 3556 1400 481b568abda95328ae140f840ce4b0ec.exe 76 PID 1400 wrote to memory of 3556 1400 481b568abda95328ae140f840ce4b0ec.exe 76 PID 1400 wrote to memory of 3556 1400 481b568abda95328ae140f840ce4b0ec.exe 76 PID 1400 wrote to memory of 3556 1400 481b568abda95328ae140f840ce4b0ec.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\481b568abda95328ae140f840ce4b0ec.exe"C:\Users\Admin\AppData\Local\Temp\481b568abda95328ae140f840ce4b0ec.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3556 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 14363⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3784
-
-