Analysis
-
max time kernel
60s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 19:32
Static task
static1
Behavioral task
behavioral1
Sample
shipping docs.exe
Resource
win7v20201028
General
-
Target
shipping docs.exe
-
Size
596KB
-
MD5
fae99f9eac22197d0f347c216fd48fad
-
SHA1
7772562ae60af041560b61286a3de0986f0aa853
-
SHA256
6e3516d6a2dc2681509e0a71ec1a58d6eb9e1b01c96e75dc248c2c5ae3250be8
-
SHA512
05fb8c9ad79c765ff4d2bb417ae9eb752c46a2c904c86632f97c5c27d4751aba2a49399b12c7182d63fa4d2e0fb66e3e48b4596758e7842a0eee59c0f32f2814
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.epaindemgroup.com - Port:
587 - Username:
ekwe@epaindemgroup.com - Password:
}bf9e+EW5s$k
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/844-54-0x0000000000447E3E-mapping.dmp family_agenttesla behavioral1/memory/844-55-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/844-53-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/844-56-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Processes:
resource yara_rule behavioral1/memory/1732-51-0x00000000009D0000-0x0000000000A1E000-memory.dmp rezer0 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
shipping docs.exedescription pid process target process PID 1732 set thread context of 844 1732 shipping docs.exe shipping docs.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
shipping docs.exeshipping docs.exepid process 1732 shipping docs.exe 1732 shipping docs.exe 1732 shipping docs.exe 844 shipping docs.exe 844 shipping docs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
shipping docs.exeshipping docs.exedescription pid process Token: SeDebugPrivilege 1732 shipping docs.exe Token: SeDebugPrivilege 844 shipping docs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
shipping docs.exepid process 844 shipping docs.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
shipping docs.exedescription pid process target process PID 1732 wrote to memory of 844 1732 shipping docs.exe shipping docs.exe PID 1732 wrote to memory of 844 1732 shipping docs.exe shipping docs.exe PID 1732 wrote to memory of 844 1732 shipping docs.exe shipping docs.exe PID 1732 wrote to memory of 844 1732 shipping docs.exe shipping docs.exe PID 1732 wrote to memory of 844 1732 shipping docs.exe shipping docs.exe PID 1732 wrote to memory of 844 1732 shipping docs.exe shipping docs.exe PID 1732 wrote to memory of 844 1732 shipping docs.exe shipping docs.exe PID 1732 wrote to memory of 844 1732 shipping docs.exe shipping docs.exe PID 1732 wrote to memory of 844 1732 shipping docs.exe shipping docs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\shipping docs.exe"C:\Users\Admin\AppData\Local\Temp\shipping docs.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\shipping docs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/844-54-0x0000000000447E3E-mapping.dmp
-
memory/844-55-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/844-53-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/844-56-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/844-57-0x00000000748A0000-0x0000000074F8E000-memory.dmpFilesize
6.9MB
-
memory/1732-0-0x00000000748A0000-0x0000000074F8E000-memory.dmpFilesize
6.9MB
-
memory/1732-1-0x00000000013E0000-0x00000000013E1000-memory.dmpFilesize
4KB
-
memory/1732-3-0x0000000000A20000-0x0000000000A78000-memory.dmpFilesize
352KB
-
memory/1732-50-0x0000000000370000-0x0000000000373000-memory.dmpFilesize
12KB
-
memory/1732-51-0x00000000009D0000-0x0000000000A1E000-memory.dmpFilesize
312KB