Analysis
-
max time kernel
96s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
21-01-2021 11:29
Static task
static1
Behavioral task
behavioral1
Sample
a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe
Resource
win10v20201028
General
-
Target
a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe
-
Size
296KB
-
MD5
f90f7228f33accb6b44274c6c07cf511
-
SHA1
5cad49a1dd5da9f40bc490170546132680ccb2a2
-
SHA256
a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268
-
SHA512
994d2a8560d384808fedb536c5ba273b9fc8e448908acdd94fde2d36324b0ed07df68603d1a8e4c0db4bad1ca1146621224ae4df8d9900e7439d733fa95b675d
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
paola.micheli@copangroup.xyz - Password:
gibson.1990
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3084-12-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/3084-13-0x000000000043761E-mapping.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
RegAsm.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegAsm.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\kprUEGC = "C:\\Users\\Admin\\AppData\\Roaming\\kprUEGC\\kprUEGC.exe" RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exedescription pid process target process PID 652 set thread context of 3084 652 a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3828 652 WerFault.exe a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exeRegAsm.exeWerFault.exepid process 652 a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe 652 a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe 3084 RegAsm.exe 3084 RegAsm.exe 3828 WerFault.exe 3828 WerFault.exe 3828 WerFault.exe 3828 WerFault.exe 3828 WerFault.exe 3828 WerFault.exe 3828 WerFault.exe 3828 WerFault.exe 3828 WerFault.exe 3828 WerFault.exe 3828 WerFault.exe 3828 WerFault.exe 3828 WerFault.exe 3828 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exeRegAsm.exeWerFault.exedescription pid process Token: SeDebugPrivilege 652 a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe Token: SeDebugPrivilege 3084 RegAsm.exe Token: SeRestorePrivilege 3828 WerFault.exe Token: SeBackupPrivilege 3828 WerFault.exe Token: SeDebugPrivilege 3828 WerFault.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 3084 RegAsm.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exedescription pid process target process PID 652 wrote to memory of 4052 652 a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe RegAsm.exe PID 652 wrote to memory of 4052 652 a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe RegAsm.exe PID 652 wrote to memory of 4052 652 a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe RegAsm.exe PID 652 wrote to memory of 3084 652 a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe RegAsm.exe PID 652 wrote to memory of 3084 652 a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe RegAsm.exe PID 652 wrote to memory of 3084 652 a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe RegAsm.exe PID 652 wrote to memory of 3084 652 a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe RegAsm.exe PID 652 wrote to memory of 3084 652 a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe RegAsm.exe PID 652 wrote to memory of 3084 652 a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe RegAsm.exe PID 652 wrote to memory of 3084 652 a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe RegAsm.exe PID 652 wrote to memory of 3084 652 a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe"C:\Users\Admin\AppData\Local\Temp\a35495ca447272d3acd4164b73c1f6e881bd0dc854f7953b4047dc79d273c268.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 16482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/652-22-0x0000000005CB0000-0x0000000005CB1000-memory.dmpFilesize
4KB
-
memory/652-5-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/652-23-0x0000000005C80000-0x0000000005C81000-memory.dmpFilesize
4KB
-
memory/652-6-0x0000000004DB0000-0x0000000004DF9000-memory.dmpFilesize
292KB
-
memory/652-7-0x0000000004F10000-0x0000000004F11000-memory.dmpFilesize
4KB
-
memory/652-8-0x00000000056E0000-0x00000000056E1000-memory.dmpFilesize
4KB
-
memory/652-9-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/652-10-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/652-2-0x0000000073DC0000-0x00000000744AE000-memory.dmpFilesize
6.9MB
-
memory/652-21-0x0000000005C20000-0x0000000005C21000-memory.dmpFilesize
4KB
-
memory/652-20-0x0000000005130000-0x0000000005131000-memory.dmpFilesize
4KB
-
memory/652-3-0x0000000000530000-0x0000000000531000-memory.dmpFilesize
4KB
-
memory/652-11-0x0000000004E30000-0x0000000004E3F000-memory.dmpFilesize
60KB
-
memory/3084-29-0x0000000005181000-0x0000000005182000-memory.dmpFilesize
4KB
-
memory/3084-12-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3084-19-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/3084-14-0x0000000073DC0000-0x00000000744AE000-memory.dmpFilesize
6.9MB
-
memory/3084-24-0x0000000005D60000-0x0000000005D61000-memory.dmpFilesize
4KB
-
memory/3084-25-0x0000000005F00000-0x0000000005F01000-memory.dmpFilesize
4KB
-
memory/3084-28-0x0000000002980000-0x0000000002981000-memory.dmpFilesize
4KB
-
memory/3084-13-0x000000000043761E-mapping.dmp
-
memory/3828-26-0x0000000004830000-0x0000000004831000-memory.dmpFilesize
4KB