Analysis
-
max time kernel
104s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
21-01-2021 14:32
Static task
static1
Behavioral task
behavioral1
Sample
Enquiry 2021.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Enquiry 2021.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
Enquiry 2021.exe
-
Size
1.7MB
-
MD5
4092525e839da8873440c5619f062285
-
SHA1
21636b3e4ededf12c6fcd9efe670a233eba35da5
-
SHA256
4683baaccd097fc0a52df310893719aab01e445170f17132451a2aa2a64c9526
-
SHA512
03659db211e5361e3327783f5f94d45492f59914fe7218c761e4dbc98fba41bdcf83464710f61caa91eab3e5f3cddf4bba96bd64c5f596f6236d9982833bfbfe
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops startup file 1 IoCs
Processes:
Enquiry 2021.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url Enquiry 2021.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Enquiry 2021.exedescription pid process target process PID 640 set thread context of 508 640 Enquiry 2021.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
MSBuild.exepid process 508 MSBuild.exe 508 MSBuild.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Enquiry 2021.exepid process 640 Enquiry 2021.exe 640 Enquiry 2021.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 508 MSBuild.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Enquiry 2021.exepid process 640 Enquiry 2021.exe 640 Enquiry 2021.exe 640 Enquiry 2021.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Enquiry 2021.exepid process 640 Enquiry 2021.exe 640 Enquiry 2021.exe 640 Enquiry 2021.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
Enquiry 2021.exedescription pid process target process PID 640 wrote to memory of 2620 640 Enquiry 2021.exe MSBuild.exe PID 640 wrote to memory of 2620 640 Enquiry 2021.exe MSBuild.exe PID 640 wrote to memory of 2620 640 Enquiry 2021.exe MSBuild.exe PID 640 wrote to memory of 508 640 Enquiry 2021.exe MSBuild.exe PID 640 wrote to memory of 508 640 Enquiry 2021.exe MSBuild.exe PID 640 wrote to memory of 508 640 Enquiry 2021.exe MSBuild.exe PID 640 wrote to memory of 508 640 Enquiry 2021.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Enquiry 2021.exe"C:\Users\Admin\AppData\Local\Temp\Enquiry 2021.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/508-2-0x00000000004375FE-mapping.dmp
-
memory/508-5-0x0000000001440000-0x0000000001441000-memory.dmpFilesize
4KB
-
memory/508-6-0x0000000001441000-0x0000000001442000-memory.dmpFilesize
4KB
-
memory/508-7-0x0000000001442000-0x0000000001443000-memory.dmpFilesize
4KB
-
memory/640-3-0x0000000000B70000-0x0000000000BA7000-memory.dmpFilesize
220KB
-
memory/640-4-0x0000000000BB0000-0x0000000000BB3000-memory.dmpFilesize
12KB