Analysis
-
max time kernel
101s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
22-01-2021 10:43
General
-
Target
DHL Details.exe
-
Size
1.2MB
-
MD5
e0ebf5297cd0ef368872846be220cb17
-
SHA1
cec0bfec250fe5f031e90ff5aaf5b15c6216f222
-
SHA256
5cd5db1f2bc06d7827e42e7e81a180b0abb3a937cd106ed0e3e2813833d3469b
-
SHA512
28925c284fc98432ca99da64d1048fb596f3d8fb7c00006d06d7646b471bd4900476cc11337b63bf9d2fc1c9f2c2adf2a7532dba2cf546fea8c9183474b1bee3
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
server126.web-hosting.com - Port:
587 - Username:
milli@emremetal.xyz - Password:
TB@h;x2zl*5c
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL Details.exe"C:\Users\Admin\AppData\Local\Temp\DHL Details.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TcqFzn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5E.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\DHL Details.exe"C:\Users\Admin\AppData\Local\Temp\DHL Details.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5E.tmpMD5
1453164963453d748e5bee32e6b0080a
SHA150dbdf2d5fbc25332ac08e53fc5c1e4e28741722
SHA25626ab17e54005f9a88cf17f10d9c335fd8d1cdaebd5abf3cd667fdcc40e3dfae4
SHA5128c0d7695b0f7efa0b2115908cf59a732c6744d6375b0318f3e8db1b83c6291eff268eaa01c56e3a9228f35b595be990fb514d86a2fff6bb8438cc8286207e1f8
-
memory/1328-12-0x00000000746F0000-0x0000000074DDE000-memory.dmpFilesize
6.9MB
-
memory/1328-10-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1328-11-0x00000000004610EE-mapping.dmp
-
memory/1328-13-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1328-15-0x0000000000A60000-0x0000000000A61000-memory.dmpFilesize
4KB
-
memory/1328-16-0x0000000000A61000-0x0000000000A62000-memory.dmpFilesize
4KB
-
memory/1636-5-0x00000000004F0000-0x0000000000513000-memory.dmpFilesize
140KB
-
memory/1636-6-0x0000000000930000-0x0000000000931000-memory.dmpFilesize
4KB
-
memory/1636-7-0x0000000005780000-0x0000000005820000-memory.dmpFilesize
640KB
-
memory/1636-3-0x0000000000E00000-0x0000000000E01000-memory.dmpFilesize
4KB
-
memory/1636-2-0x00000000746F0000-0x0000000074DDE000-memory.dmpFilesize
6.9MB
-
memory/1832-8-0x0000000000000000-mapping.dmp