Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
29-01-2021 09:01
Static task
static1
Behavioral task
behavioral1
Sample
43e914caf7c961621b5905fb1b8d9693.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
43e914caf7c961621b5905fb1b8d9693.exe
Resource
win10v20201028
General
-
Target
43e914caf7c961621b5905fb1b8d9693.exe
-
Size
949KB
-
MD5
43e914caf7c961621b5905fb1b8d9693
-
SHA1
288f6a1b5731e88d6c2702a63ca6ac4f816e53b1
-
SHA256
cab96fce527e6e090f6b3ea363017c63aaf1a40f693d6f5cc0e99945e1abd957
-
SHA512
53cc5fae8318f9f2e44ab512fe74aaf280695b41066827b686c79cd84edcccb178539090c5199912ca2ae5e70f1ea346354cc37e2a600149f6cd91b3f59eafdd
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1354395790:AAGs5t1VElMZzeygESEl5DtA0jHdLInLstE/sendDocument
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1748-10-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1748-11-0x00000000004376EE-mapping.dmp family_agenttesla behavioral1/memory/1748-13-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
43e914caf7c961621b5905fb1b8d9693.exedescription pid process target process PID 1684 set thread context of 1748 1684 43e914caf7c961621b5905fb1b8d9693.exe 43e914caf7c961621b5905fb1b8d9693.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
43e914caf7c961621b5905fb1b8d9693.exe43e914caf7c961621b5905fb1b8d9693.exepid process 1684 43e914caf7c961621b5905fb1b8d9693.exe 1684 43e914caf7c961621b5905fb1b8d9693.exe 1748 43e914caf7c961621b5905fb1b8d9693.exe 1748 43e914caf7c961621b5905fb1b8d9693.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
43e914caf7c961621b5905fb1b8d9693.exe43e914caf7c961621b5905fb1b8d9693.exedescription pid process Token: SeDebugPrivilege 1684 43e914caf7c961621b5905fb1b8d9693.exe Token: SeDebugPrivilege 1748 43e914caf7c961621b5905fb1b8d9693.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
43e914caf7c961621b5905fb1b8d9693.exedescription pid process target process PID 1684 wrote to memory of 1448 1684 43e914caf7c961621b5905fb1b8d9693.exe schtasks.exe PID 1684 wrote to memory of 1448 1684 43e914caf7c961621b5905fb1b8d9693.exe schtasks.exe PID 1684 wrote to memory of 1448 1684 43e914caf7c961621b5905fb1b8d9693.exe schtasks.exe PID 1684 wrote to memory of 1448 1684 43e914caf7c961621b5905fb1b8d9693.exe schtasks.exe PID 1684 wrote to memory of 1008 1684 43e914caf7c961621b5905fb1b8d9693.exe 43e914caf7c961621b5905fb1b8d9693.exe PID 1684 wrote to memory of 1008 1684 43e914caf7c961621b5905fb1b8d9693.exe 43e914caf7c961621b5905fb1b8d9693.exe PID 1684 wrote to memory of 1008 1684 43e914caf7c961621b5905fb1b8d9693.exe 43e914caf7c961621b5905fb1b8d9693.exe PID 1684 wrote to memory of 1008 1684 43e914caf7c961621b5905fb1b8d9693.exe 43e914caf7c961621b5905fb1b8d9693.exe PID 1684 wrote to memory of 1748 1684 43e914caf7c961621b5905fb1b8d9693.exe 43e914caf7c961621b5905fb1b8d9693.exe PID 1684 wrote to memory of 1748 1684 43e914caf7c961621b5905fb1b8d9693.exe 43e914caf7c961621b5905fb1b8d9693.exe PID 1684 wrote to memory of 1748 1684 43e914caf7c961621b5905fb1b8d9693.exe 43e914caf7c961621b5905fb1b8d9693.exe PID 1684 wrote to memory of 1748 1684 43e914caf7c961621b5905fb1b8d9693.exe 43e914caf7c961621b5905fb1b8d9693.exe PID 1684 wrote to memory of 1748 1684 43e914caf7c961621b5905fb1b8d9693.exe 43e914caf7c961621b5905fb1b8d9693.exe PID 1684 wrote to memory of 1748 1684 43e914caf7c961621b5905fb1b8d9693.exe 43e914caf7c961621b5905fb1b8d9693.exe PID 1684 wrote to memory of 1748 1684 43e914caf7c961621b5905fb1b8d9693.exe 43e914caf7c961621b5905fb1b8d9693.exe PID 1684 wrote to memory of 1748 1684 43e914caf7c961621b5905fb1b8d9693.exe 43e914caf7c961621b5905fb1b8d9693.exe PID 1684 wrote to memory of 1748 1684 43e914caf7c961621b5905fb1b8d9693.exe 43e914caf7c961621b5905fb1b8d9693.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\43e914caf7c961621b5905fb1b8d9693.exe"C:\Users\Admin\AppData\Local\Temp\43e914caf7c961621b5905fb1b8d9693.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sOJRla" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD0F5.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\43e914caf7c961621b5905fb1b8d9693.exe"C:\Users\Admin\AppData\Local\Temp\43e914caf7c961621b5905fb1b8d9693.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\43e914caf7c961621b5905fb1b8d9693.exe"C:\Users\Admin\AppData\Local\Temp\43e914caf7c961621b5905fb1b8d9693.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD0F5.tmpMD5
5658529e4be69e2b24ac8ab53302e77a
SHA1de109f57144f49aa5d47fb0de7c06e0d0d2ac089
SHA25645161e2c593f5462381590a80401554d390c1be5d979a89481c99c4da03e70df
SHA512797762a4c4104b8f14bcfda90fb45c6c382f7067a87def762cb0ebcef201d9e4468117cb326b7e85c316be828c57741229da4373533a7aa6f8b511deb92996ee
-
memory/1448-8-0x0000000000000000-mapping.dmp
-
memory/1684-2-0x0000000074670000-0x0000000074D5E000-memory.dmpFilesize
6.9MB
-
memory/1684-3-0x0000000001140000-0x0000000001141000-memory.dmpFilesize
4KB
-
memory/1684-5-0x0000000000870000-0x0000000000873000-memory.dmpFilesize
12KB
-
memory/1684-6-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/1684-7-0x0000000004DC0000-0x0000000004E29000-memory.dmpFilesize
420KB
-
memory/1748-10-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1748-11-0x00000000004376EE-mapping.dmp
-
memory/1748-12-0x0000000074670000-0x0000000074D5E000-memory.dmpFilesize
6.9MB
-
memory/1748-13-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1748-15-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB