Analysis
-
max time kernel
132s -
max time network
133s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 19:37
Behavioral task
behavioral1
Sample
PURCHASE LIST.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
PURCHASE LIST.exe
Resource
win10v20201028
General
-
Target
PURCHASE LIST.exe
-
Size
509KB
-
MD5
84bd92a1862e1c85ce69e671f74fa6e1
-
SHA1
7fa8144f716efef6b201b12672aa21882f6e1428
-
SHA256
07d6953a68436385a5c78086ae9cf68fb5f5e44adeb6333f84aaa0ffd94a0ed5
-
SHA512
ae488f9a861febe9fd96b9b44e8faf91cf8dc2c2a49f32e400a7b6e58a68a46a75a640a64985ba47818af21e7687be43676616ca7d788a71bb4f80cd5c33da04
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.mentorpublishing.co.ke - Port:
587 - Username:
info@mentorpublishing.co.ke - Password:
Sam072493
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
Processes:
resource yara_rule behavioral1/memory/344-4-0x0000000000420000-0x0000000000423000-memory.dmp coreentity -
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1888-6-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1888-7-0x000000000044CD3E-mapping.dmp family_agenttesla behavioral1/memory/1888-8-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral1/memory/1888-9-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla -
Processes:
resource yara_rule behavioral1/memory/344-5-0x0000000004360000-0x00000000043B3000-memory.dmp rezer0 -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PURCHASE LIST.exedescription pid process target process PID 344 set thread context of 1888 344 PURCHASE LIST.exe RegSvcs.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 1888 RegSvcs.exe 1888 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PURCHASE LIST.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 344 PURCHASE LIST.exe Token: SeDebugPrivilege 1888 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
PURCHASE LIST.exepid process 344 PURCHASE LIST.exe 344 PURCHASE LIST.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
PURCHASE LIST.exeRegSvcs.exedescription pid process target process PID 344 wrote to memory of 1888 344 PURCHASE LIST.exe RegSvcs.exe PID 344 wrote to memory of 1888 344 PURCHASE LIST.exe RegSvcs.exe PID 344 wrote to memory of 1888 344 PURCHASE LIST.exe RegSvcs.exe PID 344 wrote to memory of 1888 344 PURCHASE LIST.exe RegSvcs.exe PID 344 wrote to memory of 1888 344 PURCHASE LIST.exe RegSvcs.exe PID 344 wrote to memory of 1888 344 PURCHASE LIST.exe RegSvcs.exe PID 344 wrote to memory of 1888 344 PURCHASE LIST.exe RegSvcs.exe PID 344 wrote to memory of 1888 344 PURCHASE LIST.exe RegSvcs.exe PID 344 wrote to memory of 1888 344 PURCHASE LIST.exe RegSvcs.exe PID 344 wrote to memory of 1888 344 PURCHASE LIST.exe RegSvcs.exe PID 344 wrote to memory of 1888 344 PURCHASE LIST.exe RegSvcs.exe PID 344 wrote to memory of 1888 344 PURCHASE LIST.exe RegSvcs.exe PID 1888 wrote to memory of 844 1888 RegSvcs.exe REG.exe PID 1888 wrote to memory of 844 1888 RegSvcs.exe REG.exe PID 1888 wrote to memory of 844 1888 RegSvcs.exe REG.exe PID 1888 wrote to memory of 844 1888 RegSvcs.exe REG.exe PID 1888 wrote to memory of 652 1888 RegSvcs.exe netsh.exe PID 1888 wrote to memory of 652 1888 RegSvcs.exe netsh.exe PID 1888 wrote to memory of 652 1888 RegSvcs.exe netsh.exe PID 1888 wrote to memory of 652 1888 RegSvcs.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE LIST.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE LIST.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/344-0-0x0000000073FF0000-0x00000000746DE000-memory.dmpFilesize
6.9MB
-
memory/344-1-0x0000000000C70000-0x0000000000C71000-memory.dmpFilesize
4KB
-
memory/344-4-0x0000000000420000-0x0000000000423000-memory.dmpFilesize
12KB
-
memory/344-5-0x0000000004360000-0x00000000043B3000-memory.dmpFilesize
332KB
-
memory/652-14-0x0000000000000000-mapping.dmp
-
memory/844-13-0x0000000000000000-mapping.dmp
-
memory/1888-6-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1888-7-0x000000000044CD3E-mapping.dmp
-
memory/1888-8-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1888-9-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1888-10-0x00000000732D0000-0x00000000739BE000-memory.dmpFilesize
6.9MB
-
memory/2024-3-0x000007FEF7590000-0x000007FEF780A000-memory.dmpFilesize
2.5MB