Analysis
-
max time kernel
147s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-12-2020 19:32
Static task
static1
Behavioral task
behavioral1
Sample
65e86fe236bbdf389af34b2e8cf8f211.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
65e86fe236bbdf389af34b2e8cf8f211.exe
Resource
win10v20201028
General
-
Target
65e86fe236bbdf389af34b2e8cf8f211.exe
-
Size
915KB
-
MD5
65e86fe236bbdf389af34b2e8cf8f211
-
SHA1
f7d881dd7cfa27338c8bd4d820da737c8175eb58
-
SHA256
683478f861e01bef5ec49d9ecdeaafd9c156811fc2e7b0acf28f2c9ea0d0fcc1
-
SHA512
dd46add7f78d2b2c76c2dc3b6519726650689a5cf88fc32235ad45ccc4a8fba16ca15aa0248ab2dda5b40568d274b0192e914a5733031270c2b3052fea66f6b5
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.andms-kr.com - Port:
587 - Username:
and@andms-kr.com - Password:
kingwipper123
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/696-16-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/696-17-0x000000000043750E-mapping.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
65e86fe236bbdf389af34b2e8cf8f211.exedescription pid process target process PID 744 set thread context of 696 744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
65e86fe236bbdf389af34b2e8cf8f211.exepid process 696 65e86fe236bbdf389af34b2e8cf8f211.exe 696 65e86fe236bbdf389af34b2e8cf8f211.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
65e86fe236bbdf389af34b2e8cf8f211.exedescription pid process Token: SeDebugPrivilege 696 65e86fe236bbdf389af34b2e8cf8f211.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
65e86fe236bbdf389af34b2e8cf8f211.exedescription pid process target process PID 744 wrote to memory of 696 744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 744 wrote to memory of 696 744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 744 wrote to memory of 696 744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 744 wrote to memory of 696 744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 744 wrote to memory of 696 744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 744 wrote to memory of 696 744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 744 wrote to memory of 696 744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe PID 744 wrote to memory of 696 744 65e86fe236bbdf389af34b2e8cf8f211.exe 65e86fe236bbdf389af34b2e8cf8f211.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65e86fe236bbdf389af34b2e8cf8f211.exe"C:\Users\Admin\AppData\Local\Temp\65e86fe236bbdf389af34b2e8cf8f211.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\65e86fe236bbdf389af34b2e8cf8f211.exe"C:\Users\Admin\AppData\Local\Temp\65e86fe236bbdf389af34b2e8cf8f211.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\65e86fe236bbdf389af34b2e8cf8f211.exe.logMD5
65f1f0c7993639f9f9e1d524224a2c93
SHA15b51a6a56f3041dbc2d3f510252bbe68ffbbc59c
SHA256e582e80a644a998d1b2958bdcb0cd1e899076befa7c5e868d033b3fe75a2ca93
SHA5123e8953968bbc31f3105a0df28b95edfb4cee8af78ec527d47707b82e3d5fc2aa725fca574de3c963da53614e60d282408b21d075eed007be25679e9458bf1c23
-
memory/696-16-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/696-25-0x00000000063B0000-0x00000000063B1000-memory.dmpFilesize
4KB
-
memory/696-24-0x0000000005860000-0x0000000005861000-memory.dmpFilesize
4KB
-
memory/696-19-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/696-17-0x000000000043750E-mapping.dmp
-
memory/744-7-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/744-10-0x00000000057F0000-0x00000000057F1000-memory.dmpFilesize
4KB
-
memory/744-11-0x0000000026530000-0x0000000046518000-memory.dmpFilesize
511.9MB
-
memory/744-12-0x00000000469C0000-0x0000000046A17000-memory.dmpFilesize
348KB
-
memory/744-13-0x0000000004FA0000-0x0000000004FA8000-memory.dmpFilesize
32KB
-
memory/744-15-0x0000000046A20000-0x0000000046A59000-memory.dmpFilesize
228KB
-
memory/744-9-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/744-8-0x0000000002850000-0x0000000002851000-memory.dmpFilesize
4KB
-
memory/744-2-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/744-6-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/744-5-0x0000000004D50000-0x0000000004D51000-memory.dmpFilesize
4KB
-
memory/744-3-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB