Analysis
-
max time kernel
54s -
max time network
105s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 19:32
Static task
static1
Behavioral task
behavioral1
Sample
shipping docs.exe
Resource
win7v20201028
General
-
Target
shipping docs.exe
-
Size
596KB
-
MD5
fae99f9eac22197d0f347c216fd48fad
-
SHA1
7772562ae60af041560b61286a3de0986f0aa853
-
SHA256
6e3516d6a2dc2681509e0a71ec1a58d6eb9e1b01c96e75dc248c2c5ae3250be8
-
SHA512
05fb8c9ad79c765ff4d2bb417ae9eb752c46a2c904c86632f97c5c27d4751aba2a49399b12c7182d63fa4d2e0fb66e3e48b4596758e7842a0eee59c0f32f2814
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.epaindemgroup.com - Port:
587 - Username:
ekwe@epaindemgroup.com - Password:
}bf9e+EW5s$k
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3316-13-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral2/memory/3316-14-0x0000000000447E3E-mapping.dmp family_agenttesla -
Processes:
resource yara_rule behavioral2/memory/4796-12-0x0000000006E40000-0x0000000006E8E000-memory.dmp rezer0 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
shipping docs.exedescription pid process target process PID 4796 set thread context of 3316 4796 shipping docs.exe shipping docs.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
shipping docs.exeshipping docs.exepid process 4796 shipping docs.exe 4796 shipping docs.exe 4796 shipping docs.exe 3316 shipping docs.exe 3316 shipping docs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
shipping docs.exeshipping docs.exedescription pid process Token: SeDebugPrivilege 4796 shipping docs.exe Token: SeDebugPrivilege 3316 shipping docs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
shipping docs.exepid process 3316 shipping docs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
shipping docs.exedescription pid process target process PID 4796 wrote to memory of 3316 4796 shipping docs.exe shipping docs.exe PID 4796 wrote to memory of 3316 4796 shipping docs.exe shipping docs.exe PID 4796 wrote to memory of 3316 4796 shipping docs.exe shipping docs.exe PID 4796 wrote to memory of 3316 4796 shipping docs.exe shipping docs.exe PID 4796 wrote to memory of 3316 4796 shipping docs.exe shipping docs.exe PID 4796 wrote to memory of 3316 4796 shipping docs.exe shipping docs.exe PID 4796 wrote to memory of 3316 4796 shipping docs.exe shipping docs.exe PID 4796 wrote to memory of 3316 4796 shipping docs.exe shipping docs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\shipping docs.exe"C:\Users\Admin\AppData\Local\Temp\shipping docs.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\shipping docs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\shipping docs.exe.logMD5
b4f7a6a57cb46d94b72410eb6a6d45a9
SHA169f3596ffa027202d391444b769ceea0ae14c5f7
SHA25623994ebe221a48ea16ebad51ae0d4b47ccd415ae10581f9405e588d4f6c2523b
SHA512be6da516e54c3a5b33ac2603137a2f8cf8445ff5961dd266faedf3627bae8979953d7ef305538df0151c609917a5b99bf5d023bdd32de50fd5c723950f90db5c
-
memory/3316-13-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3316-22-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/3316-21-0x0000000005130000-0x0000000005131000-memory.dmpFilesize
4KB
-
memory/3316-16-0x00000000739D0000-0x00000000740BE000-memory.dmpFilesize
6.9MB
-
memory/3316-14-0x0000000000447E3E-mapping.dmp
-
memory/4796-4-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/4796-11-0x00000000085B0000-0x00000000085B1000-memory.dmpFilesize
4KB
-
memory/4796-12-0x0000000006E40000-0x0000000006E8E000-memory.dmpFilesize
312KB
-
memory/4796-10-0x0000000004EF0000-0x0000000004EF3000-memory.dmpFilesize
12KB
-
memory/4796-9-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/4796-5-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB
-
memory/4796-0-0x00000000739D0000-0x00000000740BE000-memory.dmpFilesize
6.9MB
-
memory/4796-3-0x0000000004880000-0x00000000048D8000-memory.dmpFilesize
352KB
-
memory/4796-1-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB