Analysis
- max time kernel
147s - max time network
130s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:12
Static task
static1
Behavioral task
behavioral1
Sample
PO 2207-2013-31623-AC.scr
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO 2207-2013-31623-AC.scr
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target PO 2207-2013-31623-AC.scr
- Size 1.5MB
- Sample201109-yerd242lwe
- SHA256 f7874f0fbf38ca0f147b393300b4349e00a35f84bee132f856e2d08a60ee8e89
- MD5 d43f575a5d9dcfe571a0c144f2fc5f02
- SHA1 dffefaa6baef2740000254904d3cff2403c91ab1
- SHA512 037193d9fd3c9633400f1ae5e1d2b75b6f4e77a43c7b8449aae06c1af752f99e04e64c079a645963e8e1a29a6a46e6d600736b774b9beb7274808077dfcb2982
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
agenttesla
Credentials
-
Protocol
smtp
-
Host
us2.smtp.mailhostbox.com
-
Port
587
-
Username
-
Password
mkoify147@@@
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 13 IoCs
resource yara_rule behavioral2/memory/4156-0-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla behavioral2/memory/4156-1-0x000000000044CBDE-mapping.dmp family_agenttesla behavioral2/memory/4156-11-0x000000000044CBDE-mapping.dmp family_agenttesla behavioral2/memory/4156-10-0x000000000044CBDE-mapping.dmp family_agenttesla behavioral2/memory/4156-12-0x000000000044CBDE-mapping.dmp family_agenttesla behavioral2/memory/4156-13-0x000000000044CBDE-mapping.dmp family_agenttesla behavioral2/memory/4156-14-0x000000000044CBDE-mapping.dmp family_agenttesla behavioral2/memory/4156-15-0x000000000044CBDE-mapping.dmp family_agenttesla behavioral2/memory/4156-17-0x000000000044CBDE-mapping.dmp family_agenttesla behavioral2/memory/4156-16-0x000000000044CBDE-mapping.dmp family_agenttesla behavioral2/memory/4156-18-0x000000000044CBDE-mapping.dmp family_agenttesla behavioral2/memory/4156-19-0x000000000044CBDE-mapping.dmp family_agenttesla behavioral2/memory/4156-20-0x000000000044CBDE-mapping.dmp family_agenttesla - Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iexpress.url PO 2207-2013-31623-AC.scr - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4764 set thread context of 4156 4764 PO 2207-2013-31623-AC.scr 78 - Program crash 1 IoCs
pid pid_target Process procid_target 1996 4156 WerFault.exe 78 - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 4156 MSBuild.exe 4156 MSBuild.exe 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4156 MSBuild.exe Token: SeRestorePrivilege 1996 WerFault.exe Token: SeBackupPrivilege 1996 WerFault.exe Token: SeDebugPrivilege 1996 WerFault.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr 4764 PO 2207-2013-31623-AC.scr - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4764 wrote to memory of 4156 4764 PO 2207-2013-31623-AC.scr 78 PID 4764 wrote to memory of 4156 4764 PO 2207-2013-31623-AC.scr 78 PID 4764 wrote to memory of 4156 4764 PO 2207-2013-31623-AC.scr 78 PID 4764 wrote to memory of 4156 4764 PO 2207-2013-31623-AC.scr 78 PID 4764 wrote to memory of 4156 4764 PO 2207-2013-31623-AC.scr 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 2207-2013-31623-AC.scr"C:\Users\Admin\AppData\Local\Temp\PO 2207-2013-31623-AC.scr" /S1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4156 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 14443⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
-