Analysis
-
max time kernel
101s -
max time network
17s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 15:58
Static task
static1
Behavioral task
behavioral1
Sample
190223-01PY - COSMOS.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
190223-01PY - COSMOS.exe
Resource
win10v20201028
General
-
Target
190223-01PY - COSMOS.exe
-
Size
792KB
-
MD5
c0c2ac3ac3b8a7af9f31aae937ea750c
-
SHA1
ebf17014c15dfcab53f9a81edeb6f942c7efcbc4
-
SHA256
28fa65d2b186492e5f1108e2bfa0b6babef6e12ae1dcfba019ee7065ee703caf
-
SHA512
0f6ca77a7d02bfa5d6caf488a9a77bca3db0fed58bd35520c908d7ea1d9e682cab32733b6e65787ac7ba8aa2aba3afe8bebf82af618b24eff87bc1776d954e93
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
surelylogs2@yandex.ru - Password:
uzoma1989
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1120-9-0x0000000000C00000-0x0000000000C37000-memory.dmp family_agenttesla -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
190223-01PY - COSMOS.exepid process 1120 190223-01PY - COSMOS.exe 1120 190223-01PY - COSMOS.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
190223-01PY - COSMOS.exedescription pid process Token: SeDebugPrivilege 1120 190223-01PY - COSMOS.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
190223-01PY - COSMOS.exedescription pid process target process PID 1120 wrote to memory of 1160 1120 190223-01PY - COSMOS.exe schtasks.exe PID 1120 wrote to memory of 1160 1120 190223-01PY - COSMOS.exe schtasks.exe PID 1120 wrote to memory of 1160 1120 190223-01PY - COSMOS.exe schtasks.exe PID 1120 wrote to memory of 1160 1120 190223-01PY - COSMOS.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\190223-01PY - COSMOS.exe"C:\Users\Admin\AppData\Local\Temp\190223-01PY - COSMOS.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SYeQIKtqXCFG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp167D.tmp"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp167D.tmpMD5
211a7eca25d21257d0316cb8c671377c
SHA1790ba41ee212d237a7f408d63923a1efcc9e9303
SHA25625c363b3c8d90e9891c06fafc7d3ae0fb47b9ac856a9b6cb7223069614be3c13
SHA5121f9624a3017bca032b12b4404054097d8ce522b660275e4305e583a7d8587e340f7bc2e11747839273f863a15e0635c6712b2ddfb9af395e83548ca365e1a351
-
memory/1120-2-0x0000000074B10000-0x00000000751FE000-memory.dmpFilesize
6.9MB
-
memory/1120-3-0x0000000001320000-0x0000000001321000-memory.dmpFilesize
4KB
-
memory/1120-5-0x0000000000260000-0x0000000000272000-memory.dmpFilesize
72KB
-
memory/1120-6-0x0000000005340000-0x00000000053B5000-memory.dmpFilesize
468KB
-
memory/1120-9-0x0000000000C00000-0x0000000000C37000-memory.dmpFilesize
220KB
-
memory/1160-7-0x0000000000000000-mapping.dmp