Analysis
-
max time kernel
103s -
max time network
15s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-01-2021 09:59
Static task
static1
Behavioral task
behavioral1
Sample
AWB & Shipping Document.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
AWB & Shipping Document.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
AWB & Shipping Document.exe
-
Size
1.1MB
-
MD5
7fb34ce8d9791b9ecfc9ceec60fe4c5a
-
SHA1
cf0b73e45c0239865d3be930aced04a1513d0194
-
SHA256
08f8fb048455eaa71cf153651e2c8643e1669ad29be5f523de0b8bb39996e92c
-
SHA512
379a410db297833dab382b9f9bbf842bbd71091a61184b74153025bab1151b78eaaaf43caa07f3c8db47a33b0063cb362642944a1e89b86cd682562fa9ca3ed6
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
smtp.trgcomq.com - Port:
587 - Username:
reyna@trgcomq.com - Password:
djxAXxTla8
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1664-7-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1664-8-0x00000000004375EE-mapping.dmp family_agenttesla behavioral1/memory/1664-9-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1664-10-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
AWB & Shipping Document.exedescription pid process target process PID 1204 set thread context of 1664 1204 AWB & Shipping Document.exe AWB & Shipping Document.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AWB & Shipping Document.exepid process 1664 AWB & Shipping Document.exe 1664 AWB & Shipping Document.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AWB & Shipping Document.exedescription pid process Token: SeDebugPrivilege 1664 AWB & Shipping Document.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
AWB & Shipping Document.exedescription pid process target process PID 1204 wrote to memory of 1664 1204 AWB & Shipping Document.exe AWB & Shipping Document.exe PID 1204 wrote to memory of 1664 1204 AWB & Shipping Document.exe AWB & Shipping Document.exe PID 1204 wrote to memory of 1664 1204 AWB & Shipping Document.exe AWB & Shipping Document.exe PID 1204 wrote to memory of 1664 1204 AWB & Shipping Document.exe AWB & Shipping Document.exe PID 1204 wrote to memory of 1664 1204 AWB & Shipping Document.exe AWB & Shipping Document.exe PID 1204 wrote to memory of 1664 1204 AWB & Shipping Document.exe AWB & Shipping Document.exe PID 1204 wrote to memory of 1664 1204 AWB & Shipping Document.exe AWB & Shipping Document.exe PID 1204 wrote to memory of 1664 1204 AWB & Shipping Document.exe AWB & Shipping Document.exe PID 1204 wrote to memory of 1664 1204 AWB & Shipping Document.exe AWB & Shipping Document.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AWB & Shipping Document.exe"C:\Users\Admin\AppData\Local\Temp\AWB & Shipping Document.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AWB & Shipping Document.exe"C:\Users\Admin\AppData\Local\Temp\AWB & Shipping Document.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1204-2-0x00000000740B0000-0x000000007479E000-memory.dmpFilesize
6.9MB
-
memory/1204-3-0x00000000008E0000-0x00000000008E1000-memory.dmpFilesize
4KB
-
memory/1204-5-0x00000000004E0000-0x00000000004F2000-memory.dmpFilesize
72KB
-
memory/1204-6-0x0000000005310000-0x0000000005384000-memory.dmpFilesize
464KB
-
memory/1664-7-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1664-8-0x00000000004375EE-mapping.dmp
-
memory/1664-9-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1664-10-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1664-11-0x00000000740B0000-0x000000007479E000-memory.dmpFilesize
6.9MB