Analysis
-
max time kernel
102s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
04-12-2020 19:32
Static task
static1
Behavioral task
behavioral1
Sample
65e86fe236bbdf389af34b2e8cf8f211.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
65e86fe236bbdf389af34b2e8cf8f211.exe
Resource
win10v20201028
General
-
Target
65e86fe236bbdf389af34b2e8cf8f211.exe
-
Size
915KB
-
MD5
65e86fe236bbdf389af34b2e8cf8f211
-
SHA1
f7d881dd7cfa27338c8bd4d820da737c8175eb58
-
SHA256
683478f861e01bef5ec49d9ecdeaafd9c156811fc2e7b0acf28f2c9ea0d0fcc1
-
SHA512
dd46add7f78d2b2c76c2dc3b6519726650689a5cf88fc32235ad45ccc4a8fba16ca15aa0248ab2dda5b40568d274b0192e914a5733031270c2b3052fea66f6b5
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.andms-kr.com - Port:
587 - Username:
[email protected] - Password:
kingwipper123
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/996-10-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/996-11-0x000000000043750E-mapping.dmp family_agenttesla behavioral1/memory/996-12-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/996-13-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
65e86fe236bbdf389af34b2e8cf8f211.exedescription pid process target process PID 1744 set thread context of 996 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
65e86fe236bbdf389af34b2e8cf8f211.exe65e86fe236bbdf389af34b2e8cf8f211.exepid process 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 996 65e86fe236bbdf389af34b2e8cf8f211.exe 996 65e86fe236bbdf389af34b2e8cf8f211.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
65e86fe236bbdf389af34b2e8cf8f211.exe65e86fe236bbdf389af34b2e8cf8f211.exedescription pid process Token: SeDebugPrivilege 1744 65e86fe236bbdf389af34b2e8cf8f211.exe Token: SeDebugPrivilege 996 65e86fe236bbdf389af34b2e8cf8f211.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
65e86fe236bbdf389af34b2e8cf8f211.exedescription pid process target process PID 1744 wrote to memory of 276 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 1744 wrote to memory of 276 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 1744 wrote to memory of 276 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 1744 wrote to memory of 276 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 1744 wrote to memory of 784 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 1744 wrote to memory of 784 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 1744 wrote to memory of 784 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 1744 wrote to memory of 784 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 1744 wrote to memory of 996 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 1744 wrote to memory of 996 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 1744 wrote to memory of 996 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 1744 wrote to memory of 996 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 1744 wrote to memory of 996 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 1744 wrote to memory of 996 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 1744 wrote to memory of 996 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 1744 wrote to memory of 996 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 1744 wrote to memory of 996 1744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65e86fe236bbdf389af34b2e8cf8f211.exe"C:\Users\Admin\AppData\Local\Temp\65e86fe236bbdf389af34b2e8cf8f211.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\65e86fe236bbdf389af34b2e8cf8f211.exe"C:\Users\Admin\AppData\Local\Temp\65e86fe236bbdf389af34b2e8cf8f211.exe"2⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\65e86fe236bbdf389af34b2e8cf8f211.exe"C:\Users\Admin\AppData\Local\Temp\65e86fe236bbdf389af34b2e8cf8f211.exe"2⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\65e86fe236bbdf389af34b2e8cf8f211.exe"C:\Users\Admin\AppData\Local\Temp\65e86fe236bbdf389af34b2e8cf8f211.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:996
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/996-10-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/996-11-0x000000000043750E-mapping.dmp
-
memory/996-12-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/996-13-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/996-14-0x0000000073F40000-0x000000007462E000-memory.dmpFilesize
6.9MB
-
memory/1744-2-0x0000000073F40000-0x000000007462E000-memory.dmpFilesize
6.9MB
-
memory/1744-3-0x0000000000A70000-0x0000000000A71000-memory.dmpFilesize
4KB
-
memory/1744-5-0x0000000025780000-0x0000000045768000-memory.dmpFilesize
511.9MB
-
memory/1744-6-0x0000000004D00000-0x0000000004D57000-memory.dmpFilesize
348KB
-
memory/1744-7-0x00000000006D0000-0x00000000006D8000-memory.dmpFilesize
32KB
-
memory/1744-9-0x0000000045770000-0x00000000457A9000-memory.dmpFilesize
228KB