Analysis
-
max time kernel
93s -
max time network
102s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 20:23
Static task
static1
Behavioral task
behavioral1
Sample
pricing list.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
pricing list.exe
Resource
win10v20201028
General
-
Target
pricing list.exe
-
Size
424KB
-
MD5
9c63aa40d3def6ab9c83628bb8206dee
-
SHA1
042b99a97749b4e61dcfe0bbafc38e8b508e271b
-
SHA256
09542d5ce4d6e162e9dd0037b9645c67505f59039462b508b1aef9f45d156fb6
-
SHA512
4cb83731b4116bd6f1eec9b2a66ba09a8287cc3047e2ab22d095593e3cbc1763fd3f2b5412f9eb8c3d1a31c14b49276c6f2bff52986ac60df1594f93e5bdbbf3
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.unitednationpk.com - Port:
587 - Username:
unite@unitednationpk.com - Password:
Playground12345
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/812-2-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral2/memory/812-3-0x000000000040188B-mapping.dmp family_agenttesla behavioral2/memory/4772-4-0x0000000000CC0000-0x0000000000D0C000-memory.dmp family_agenttesla behavioral2/memory/812-5-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral2/memory/812-7-0x0000000002880000-0x00000000028B7000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
pricing list.exedescription pid process target process PID 4772 set thread context of 812 4772 pricing list.exe pricing list.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
pricing list.exepid process 812 pricing list.exe 812 pricing list.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
pricing list.exepid process 4772 pricing list.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
pricing list.exedescription pid process Token: SeDebugPrivilege 812 pricing list.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
pricing list.exedescription pid process target process PID 4772 wrote to memory of 812 4772 pricing list.exe pricing list.exe PID 4772 wrote to memory of 812 4772 pricing list.exe pricing list.exe PID 4772 wrote to memory of 812 4772 pricing list.exe pricing list.exe PID 4772 wrote to memory of 812 4772 pricing list.exe pricing list.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\pricing list.exe"C:\Users\Admin\AppData\Local\Temp\pricing list.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pricing list.exe"C:\Users\Admin\AppData\Local\Temp\pricing list.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/812-2-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/812-3-0x000000000040188B-mapping.dmp
-
memory/812-5-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/812-6-0x0000000073070000-0x000000007375E000-memory.dmpFilesize
6.9MB
-
memory/812-7-0x0000000002880000-0x00000000028B7000-memory.dmpFilesize
220KB
-
memory/812-9-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/812-10-0x0000000004FE0000-0x0000000004FE1000-memory.dmpFilesize
4KB
-
memory/812-11-0x0000000005D70000-0x0000000005D71000-memory.dmpFilesize
4KB
-
memory/812-12-0x0000000005E10000-0x0000000005E11000-memory.dmpFilesize
4KB
-
memory/812-13-0x0000000006180000-0x0000000006181000-memory.dmpFilesize
4KB
-
memory/812-14-0x00000000060E0000-0x00000000060E1000-memory.dmpFilesize
4KB
-
memory/4772-4-0x0000000000CC0000-0x0000000000D0C000-memory.dmpFilesize
304KB