Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    22-01-2021 15:01

General

  • Target

    SOA.exe

  • Size

    569KB

  • MD5

    1367e39bbc813a591450821d14fcee00

  • SHA1

    7b256a62cdf9fc4f9f9e01ba7bcd59c0be57f26b

  • SHA256

    556ed5ff3846f0bd67b9dce457aa749c843a164f644accde3ed5b87851a34abe

  • SHA512

    30e7e340156e0fe6f75919da9c6e3ea773e7343cbe09bc3be11b8b2f8b1f3272177d8a53a7ace571f8dfc084881d7e637ae6d244afce2f60e0791b3bcf3a7877

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    paola.micheli@copangroup.xyz
  • Password:
    gibson.1990

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload 3 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SOA.exe
    "C:\Users\Admin\AppData\Local\Temp\SOA.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:2004
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
          PID:2028
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
          • Drops file in Drivers directory
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1976
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 1144
          2⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:560

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      1
      T1112

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/560-20-0x0000000000530000-0x0000000000531000-memory.dmp
        Filesize

        4KB

      • memory/560-19-0x0000000002410000-0x0000000002421000-memory.dmp
        Filesize

        68KB

      • memory/560-18-0x0000000000000000-mapping.dmp
      • memory/1864-17-0x0000000000CB0000-0x0000000000CB1000-memory.dmp
        Filesize

        4KB

      • memory/1864-3-0x0000000001330000-0x0000000001331000-memory.dmp
        Filesize

        4KB

      • memory/1864-5-0x0000000001100000-0x0000000001101000-memory.dmp
        Filesize

        4KB

      • memory/1864-6-0x0000000000B20000-0x0000000000B69000-memory.dmp
        Filesize

        292KB

      • memory/1864-7-0x0000000001105000-0x0000000001116000-memory.dmp
        Filesize

        68KB

      • memory/1864-8-0x0000000000410000-0x000000000041F000-memory.dmp
        Filesize

        60KB

      • memory/1864-9-0x0000000001116000-0x0000000001117000-memory.dmp
        Filesize

        4KB

      • memory/1864-2-0x00000000743D0000-0x0000000074ABE000-memory.dmp
        Filesize

        6.9MB

      • memory/1976-11-0x000000000043761E-mapping.dmp
      • memory/1976-16-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
        Filesize

        4KB

      • memory/1976-14-0x0000000000400000-0x000000000043C000-memory.dmp
        Filesize

        240KB

      • memory/1976-13-0x00000000743D0000-0x0000000074ABE000-memory.dmp
        Filesize

        6.9MB

      • memory/1976-12-0x00000000760B1000-0x00000000760B3000-memory.dmp
        Filesize

        8KB

      • memory/1976-10-0x0000000000400000-0x000000000043C000-memory.dmp
        Filesize

        240KB

      • memory/1976-21-0x0000000004DE1000-0x0000000004DE2000-memory.dmp
        Filesize

        4KB