Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
25-01-2021 16:23
General
-
Target
order-2020-PO_0834.exe
-
Size
769KB
-
MD5
1da2611d005b3e9772473c6c6a30a4bb
-
SHA1
c6a2394c14529f9569a8cb4fa97f6d561d848118
-
SHA256
da62030389950c96e25e406e2c698b25cfacd49ecbdaa986421fb7995d2ee314
-
SHA512
9b796e625a8ae2118f3b57b8d1fa5a5076bcdfa5bcabf3b85d79853508a0cb8836c6fd1dfbbe66ae152b4224217f0f243b531c97f7bbff5f068270c8f48a727c
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.grandtours.gr - Port:
587 - Username:
[email protected] - Password:
!ugochukwu1-4-7!???rex
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\order-2020-PO_0834.exe"C:\Users\Admin\AppData\Local\Temp\order-2020-PO_0834.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VkdmIUfSlA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6D03.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\order-2020-PO_0834.exe"C:\Users\Admin\AppData\Local\Temp\order-2020-PO_0834.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\order-2020-PO_0834.exe.logMD5
c3cc52ccca9ff2b6fa8d267fc350ca6b
SHA1a68d4028333296d222e4afd75dea36fdc98d05f3
SHA2563125b6071e2d78f575a06ed7ac32a83d9262ae64d1fa81ac43e8bfc1ef157c0e
SHA512b0c7b2501b1a2c559795a9d178c0bbda0e03cbdbaaa2c4330ac1202a55373fe1b742078adcfa915bd6e805565a2daa6d35d64ef7a14ffcd09069f9ea6a691cc7
-
C:\Users\Admin\AppData\Local\Temp\tmp6D03.tmpMD5
a34af0df5b0a4661bfb6f1e977558fcf
SHA13febbfdaa07195ee5f13083fb53bd845c2fdb0b7
SHA256b55c26457f9d93677107e1a35fc6d4881662e2d4f7e1563d15aa370e30d764cf
SHA5123abc9fc77e4acb4df2bf7a437bcac9d7cf893a617e77f3c21ad362b424b26a2b1ff42c1fe824b7d7c1d2a7e60e270798633075ff0bc42ae34e58f43b50cb6c15
-
memory/192-12-0x0000000000000000-mapping.dmp
-
memory/1924-11-0x0000000006150000-0x00000000061BA000-memory.dmpFilesize
424KB
-
memory/1924-5-0x00000000058E0000-0x00000000058E1000-memory.dmpFilesize
4KB
-
memory/1924-8-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/1924-9-0x0000000005430000-0x0000000005431000-memory.dmpFilesize
4KB
-
memory/1924-10-0x0000000005450000-0x0000000005453000-memory.dmpFilesize
12KB
-
memory/1924-2-0x0000000073900000-0x0000000073FEE000-memory.dmpFilesize
6.9MB
-
memory/1924-6-0x0000000005480000-0x0000000005481000-memory.dmpFilesize
4KB
-
memory/1924-7-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/1924-3-0x0000000000B40000-0x0000000000B41000-memory.dmpFilesize
4KB
-
memory/2304-15-0x00000000004374BE-mapping.dmp
-
memory/2304-14-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2304-17-0x0000000073900000-0x0000000073FEE000-memory.dmpFilesize
6.9MB
-
memory/2304-22-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/2304-23-0x0000000005B00000-0x0000000005B01000-memory.dmpFilesize
4KB
-
memory/2304-24-0x00000000061C0000-0x00000000061C1000-memory.dmpFilesize
4KB