OCXQZK3KWmWNdRx.exe

General
Target

OCXQZK3KWmWNdRx.exe

Filesize

803KB

Completed

22-01-2021 10:20

Score
10 /10
MD5

c6286c765c37478223b99c6ab0dc96f5

SHA1

eb043c7435526162e7e3a85005421fba3c1f3618

SHA256

8392af9cff73aab10a60befd359d4ca2638d6a936071285579147303bb453497

Malware Config

Extracted

Family agenttesla
Credentials

Protocol: smtp

Host: mail.flood-protection.org

Port: 587

Username: uchedon@flood-protection.org

Password: uchedon2424@

Signatures 6

Filter: none

  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1668-8-0x0000000000400000-0x000000000043C000-memory.dmpfamily_agenttesla
    behavioral1/memory/1668-9-0x00000000004374DE-mapping.dmpfamily_agenttesla
    behavioral1/memory/1668-11-0x0000000000400000-0x000000000043C000-memory.dmpfamily_agenttesla
  • Suspicious use of SetThreadContext
    OCXQZK3KWmWNdRx.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1336 set thread context of 16681336OCXQZK3KWmWNdRx.exeOCXQZK3KWmWNdRx.exe
  • Suspicious behavior: EnumeratesProcesses
    OCXQZK3KWmWNdRx.exeOCXQZK3KWmWNdRx.exe

    Reported IOCs

    pidprocess
    1336OCXQZK3KWmWNdRx.exe
    1336OCXQZK3KWmWNdRx.exe
    1668OCXQZK3KWmWNdRx.exe
    1668OCXQZK3KWmWNdRx.exe
  • Suspicious use of AdjustPrivilegeToken
    OCXQZK3KWmWNdRx.exeOCXQZK3KWmWNdRx.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1336OCXQZK3KWmWNdRx.exe
    Token: SeDebugPrivilege1668OCXQZK3KWmWNdRx.exe
  • Suspicious use of WriteProcessMemory
    OCXQZK3KWmWNdRx.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1336 wrote to memory of 17161336OCXQZK3KWmWNdRx.exeOCXQZK3KWmWNdRx.exe
    PID 1336 wrote to memory of 17161336OCXQZK3KWmWNdRx.exeOCXQZK3KWmWNdRx.exe
    PID 1336 wrote to memory of 17161336OCXQZK3KWmWNdRx.exeOCXQZK3KWmWNdRx.exe
    PID 1336 wrote to memory of 17161336OCXQZK3KWmWNdRx.exeOCXQZK3KWmWNdRx.exe
    PID 1336 wrote to memory of 16681336OCXQZK3KWmWNdRx.exeOCXQZK3KWmWNdRx.exe
    PID 1336 wrote to memory of 16681336OCXQZK3KWmWNdRx.exeOCXQZK3KWmWNdRx.exe
    PID 1336 wrote to memory of 16681336OCXQZK3KWmWNdRx.exeOCXQZK3KWmWNdRx.exe
    PID 1336 wrote to memory of 16681336OCXQZK3KWmWNdRx.exeOCXQZK3KWmWNdRx.exe
    PID 1336 wrote to memory of 16681336OCXQZK3KWmWNdRx.exeOCXQZK3KWmWNdRx.exe
    PID 1336 wrote to memory of 16681336OCXQZK3KWmWNdRx.exeOCXQZK3KWmWNdRx.exe
    PID 1336 wrote to memory of 16681336OCXQZK3KWmWNdRx.exeOCXQZK3KWmWNdRx.exe
    PID 1336 wrote to memory of 16681336OCXQZK3KWmWNdRx.exeOCXQZK3KWmWNdRx.exe
    PID 1336 wrote to memory of 16681336OCXQZK3KWmWNdRx.exeOCXQZK3KWmWNdRx.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\OCXQZK3KWmWNdRx.exe
    "C:\Users\Admin\AppData\Local\Temp\OCXQZK3KWmWNdRx.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Users\Admin\AppData\Local\Temp\OCXQZK3KWmWNdRx.exe
      "C:\Users\Admin\AppData\Local\Temp\OCXQZK3KWmWNdRx.exe"
      PID:1716
    • C:\Users\Admin\AppData\Local\Temp\OCXQZK3KWmWNdRx.exe
      "C:\Users\Admin\AppData\Local\Temp\OCXQZK3KWmWNdRx.exe"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1668
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/1336-2-0x0000000073980000-0x000000007406E000-memory.dmp

                          • memory/1336-3-0x0000000000810000-0x0000000000811000-memory.dmp

                          • memory/1336-5-0x0000000000A40000-0x0000000000A63000-memory.dmp

                          • memory/1336-6-0x00000000022A0000-0x00000000022A1000-memory.dmp

                          • memory/1336-7-0x00000000050D0000-0x0000000005147000-memory.dmp

                          • memory/1668-8-0x0000000000400000-0x000000000043C000-memory.dmp

                          • memory/1668-9-0x00000000004374DE-mapping.dmp

                          • memory/1668-10-0x0000000073980000-0x000000007406E000-memory.dmp

                          • memory/1668-11-0x0000000000400000-0x000000000043C000-memory.dmp

                          • memory/1668-13-0x0000000004D00000-0x0000000004D01000-memory.dmp