Analysis
-
max time kernel
300s -
max time network
118s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
20-01-2021 10:26
Static task
static1
Behavioral task
behavioral1
Sample
New Order.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
New Order.exe
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
smtp.airlndia.in - Port:
587 - Username:
ikorigin@airlndia.in - Password:
pkqNqbW9
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/788-6-0x0000000000400000-0x0000000000466000-memory.dmp family_agenttesla -
Drops startup file 1 IoCs
Processes:
New Order.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url New Order.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
New Order.exedescription pid process target process PID 4648 set thread context of 788 4648 New Order.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
MSBuild.exepid process 788 MSBuild.exe 788 MSBuild.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
New Order.exepid process 4648 New Order.exe 4648 New Order.exe 4648 New Order.exe 4648 New Order.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 788 MSBuild.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
New Order.exepid process 4648 New Order.exe 4648 New Order.exe 4648 New Order.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
New Order.exepid process 4648 New Order.exe 4648 New Order.exe 4648 New Order.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
New Order.exedescription pid process target process PID 4648 wrote to memory of 688 4648 New Order.exe MSBuild.exe PID 4648 wrote to memory of 688 4648 New Order.exe MSBuild.exe PID 4648 wrote to memory of 688 4648 New Order.exe MSBuild.exe PID 4648 wrote to memory of 720 4648 New Order.exe MSBuild.exe PID 4648 wrote to memory of 720 4648 New Order.exe MSBuild.exe PID 4648 wrote to memory of 720 4648 New Order.exe MSBuild.exe PID 4648 wrote to memory of 756 4648 New Order.exe MSBuild.exe PID 4648 wrote to memory of 756 4648 New Order.exe MSBuild.exe PID 4648 wrote to memory of 756 4648 New Order.exe MSBuild.exe PID 4648 wrote to memory of 788 4648 New Order.exe MSBuild.exe PID 4648 wrote to memory of 788 4648 New Order.exe MSBuild.exe PID 4648 wrote to memory of 788 4648 New Order.exe MSBuild.exe PID 4648 wrote to memory of 788 4648 New Order.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order.exe"C:\Users\Admin\AppData\Local\Temp\New Order.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/788-2-0x00000000004613FE-mapping.dmp
-
memory/788-3-0x00000000737B0000-0x0000000073E9E000-memory.dmpFilesize
6.9MB
-
memory/788-6-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/788-8-0x0000000005A40000-0x0000000005A41000-memory.dmpFilesize
4KB
-
memory/788-9-0x0000000005350000-0x0000000005351000-memory.dmpFilesize
4KB
-
memory/788-10-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/788-11-0x00000000054F0000-0x00000000054F1000-memory.dmpFilesize
4KB
-
memory/788-12-0x00000000059A0000-0x00000000059A1000-memory.dmpFilesize
4KB
-
memory/788-13-0x0000000006680000-0x0000000006681000-memory.dmpFilesize
4KB
-
memory/788-14-0x0000000006350000-0x0000000006351000-memory.dmpFilesize
4KB
-
memory/4648-4-0x0000000004010000-0x0000000004071000-memory.dmpFilesize
388KB
-
memory/4648-5-0x00000000026E0000-0x00000000026E3000-memory.dmpFilesize
12KB