Analysis
-
max time kernel
107s -
max time network
107s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
21-01-2021 18:32
Static task
static1
Behavioral task
behavioral1
Sample
kdotx.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
kdotx.exe
Resource
win10v20201028
General
-
Target
kdotx.exe
-
Size
57KB
-
MD5
b95249a3ceacb06a049d3f211479fc7e
-
SHA1
5de29c60c381140276e5e96b473018a73bdd53eb
-
SHA256
bd600300188d8cb735f9e4afcc580398a2842126c9a5e884259fd2d46ac103af
-
SHA512
3591c84202c405366e4fb38befabfe14fa3324745e32d1cc254c803e4e9a4bb7871afba6ee4649a2f33f97186640acbab2e75da4be9440d52711e416eac9bf47
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.sardaplywood.com - Port:
587 - Username:
superstars@sardaplywood.com - Password:
sup123st45
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1684-6-0x0000000004BC0000-0x0000000004C1C000-memory.dmp family_agenttesla behavioral1/memory/888-7-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/888-8-0x000000000043769E-mapping.dmp family_agenttesla behavioral1/memory/1216-17-0x000000000043769E-mapping.dmp family_agenttesla behavioral1/memory/888-14-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/932-20-0x000000000043769E-mapping.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 api.ipify.org 7 api.ipify.org -
Suspicious use of NtSetInformationThreadHideFromDebugger 40 IoCs
Processes:
kdotx.exepid process 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe 1684 kdotx.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
kdotx.exedescription pid process target process PID 1684 set thread context of 888 1684 kdotx.exe kdotx.exe PID 1684 set thread context of 1448 1684 kdotx.exe kdotx.exe PID 1684 set thread context of 1216 1684 kdotx.exe kdotx.exe PID 1684 set thread context of 932 1684 kdotx.exe kdotx.exe PID 1684 set thread context of 1364 1684 kdotx.exe kdotx.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 440 1684 WerFault.exe kdotx.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
kdotx.exekdotx.exekdotx.exekdotx.exepid process 1684 kdotx.exe 1684 kdotx.exe 1448 kdotx.exe 1448 kdotx.exe 1216 kdotx.exe 1216 kdotx.exe 888 kdotx.exe 888 kdotx.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
kdotx.exekdotx.exekdotx.exekdotx.exedescription pid process Token: SeDebugPrivilege 1684 kdotx.exe Token: SeDebugPrivilege 1448 kdotx.exe Token: SeDebugPrivilege 1216 kdotx.exe Token: SeDebugPrivilege 888 kdotx.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
kdotx.exepid process 1216 kdotx.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
kdotx.exedescription pid process target process PID 1684 wrote to memory of 888 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 888 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 888 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 888 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 888 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 888 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 888 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 888 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 888 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1448 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1448 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1448 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1448 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1448 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1448 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1448 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1448 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1448 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1216 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1216 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1216 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1216 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1216 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1216 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1216 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1216 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1216 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 932 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 932 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 932 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 932 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 932 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 932 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 932 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 932 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 932 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1364 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1364 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1364 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1364 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1364 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1364 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1364 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1364 1684 kdotx.exe kdotx.exe PID 1684 wrote to memory of 1364 1684 kdotx.exe kdotx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\kdotx.exe"C:\Users\Admin\AppData\Local\Temp\kdotx.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kdotx.exe"C:\Users\Admin\AppData\Local\Temp\kdotx.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\kdotx.exe"C:\Users\Admin\AppData\Local\Temp\kdotx.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\kdotx.exe"C:\Users\Admin\AppData\Local\Temp\kdotx.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\kdotx.exe"C:\Users\Admin\AppData\Local\Temp\kdotx.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\kdotx.exe"C:\Users\Admin\AppData\Local\Temp\kdotx.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 11082⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/888-14-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/888-33-0x0000000004880000-0x0000000004881000-memory.dmpFilesize
4KB
-
memory/888-7-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/888-8-0x000000000043769E-mapping.dmp
-
memory/888-11-0x0000000074670000-0x0000000074D5E000-memory.dmpFilesize
6.9MB
-
memory/932-22-0x0000000074670000-0x0000000074D5E000-memory.dmpFilesize
6.9MB
-
memory/932-20-0x000000000043769E-mapping.dmp
-
memory/1216-34-0x00000000049E1000-0x00000000049E2000-memory.dmpFilesize
4KB
-
memory/1216-32-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/1216-19-0x0000000074670000-0x0000000074D5E000-memory.dmpFilesize
6.9MB
-
memory/1216-17-0x000000000043769E-mapping.dmp
-
memory/1364-27-0x000000000043769E-mapping.dmp
-
memory/1364-28-0x0000000074670000-0x0000000074D5E000-memory.dmpFilesize
6.9MB
-
memory/1448-13-0x0000000074670000-0x0000000074D5E000-memory.dmpFilesize
6.9MB
-
memory/1448-10-0x000000000043769E-mapping.dmp
-
memory/1448-31-0x0000000004810000-0x0000000004811000-memory.dmpFilesize
4KB
-
memory/1684-12-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/1684-2-0x0000000074670000-0x0000000074D5E000-memory.dmpFilesize
6.9MB
-
memory/1684-6-0x0000000004BC0000-0x0000000004C1C000-memory.dmpFilesize
368KB
-
memory/1684-5-0x0000000000D60000-0x0000000000D61000-memory.dmpFilesize
4KB
-
memory/1684-3-0x0000000000F40000-0x0000000000F41000-memory.dmpFilesize
4KB