Analysis
-
max time kernel
96s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-01-2021 10:22
General
-
Target
ORDER-9087.exe
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDER-9087.exe"C:\Users\Admin\AppData\Local\Temp\ORDER-9087.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nla\sekcqfb.exeC:\Users\Admin\AppData\Local\Temp\Nla\sekcqfb.exe C:\Users\Admin\AppData\Local\Temp\Nla\dragubcuw.vza2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nla\rttty72nv.exeC:\Users\Admin\AppData\Local\Temp\Nla\sekcqfb.exe C:\Users\Admin\AppData\Local\Temp\Nla\dragubcuw.vza3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
35c8169a76f07c2ef9cc306aae3a923f
SHA1e4bdc01083c6938d0b1fa6341c2412aa34dfb37b
SHA256946ef660c14f1a9c817553ff1f264e4fd5bd272a857c99ea9798c727e75a73e2
SHA51249439919d46549908d2022c886b770ea9aeff350a5258cbae5f4e14c2ab9eb8098f3aaa6322cec0f6641fcc0de676eb83ecba4644aa07cc397614beab6fcbe0e
-
MD5
535dd1329aef11bf4654b3270f026d5b
SHA19c84de0bde8333f852120ab40710545b3f799300
SHA256b31445fc4b8803d1b7122a6563002cfe3e925ffd1fdc9b84fba6fc78f6a8b955
SHA512a552e20a09a796a6e3e18dece308880069c958cf9136bb4fc3ee726d6bc9b2f8eddbcff06ff9f9ded4dd268f5d0f39d516ad42ecce6455a4bf5cf4f3cb4c4ecc
-
MD5
c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
MD5
c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
MD5
a1c890effda03ce27a5df996d7692fa3
SHA12dafe7a1f6f86f5ef0f692d8093e92e07c445f4d
SHA256eeb0d64753cf0d3942f37930dd2f37d3a7111688bf106a9068734f9cfa42280b
SHA5129ded8ea17c20a31ce43085d2808618efaeb425a72b48eb11878b23bb2024cabb3b78cf72429fe46ae87eb1f64eddd0b18a23c48bedc0a16fee78fbb33e23af06
-
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
-
Filesize
8KB