Analysis
-
max time kernel
150s -
max time network
68s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-02-2021 09:57
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe
Resource
win10v20201028
General
-
Target
SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe
-
Size
523KB
-
MD5
c4242be5efb3c3833c20e3ca293c7375
-
SHA1
aa8c78515a6f0043c08b74fe142654ed59da5124
-
SHA256
a2f1773e4b9146563dbf711ca1462448a7a847f8b6660424f72faaa5fa9b20d4
-
SHA512
6b11e6706a75175e2890348c9de8464b6989dc2938ed54651a2e08b999b84b50f38f58aaff8730f48117e61cd93840a9352fe66761b55d4ebc9140b9eb27308b
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
GODBLESSUS123
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1288-15-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/1288-16-0x000000000043749E-mapping.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exedescription pid process target process PID 1144 set thread context of 1288 1144 SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exeSecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exepid process 1144 SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe 1288 SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe 1288 SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exeSecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exedescription pid process Token: SeDebugPrivilege 1144 SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe Token: SeDebugPrivilege 1288 SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exedescription pid process target process PID 1144 wrote to memory of 768 1144 SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe schtasks.exe PID 1144 wrote to memory of 768 1144 SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe schtasks.exe PID 1144 wrote to memory of 768 1144 SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe schtasks.exe PID 1144 wrote to memory of 1288 1144 SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe PID 1144 wrote to memory of 1288 1144 SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe PID 1144 wrote to memory of 1288 1144 SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe PID 1144 wrote to memory of 1288 1144 SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe PID 1144 wrote to memory of 1288 1144 SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe PID 1144 wrote to memory of 1288 1144 SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe PID 1144 wrote to memory of 1288 1144 SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe PID 1144 wrote to memory of 1288 1144 SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nNqaGW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6415.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.73184.11258.19381.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6415.tmpMD5
4d6ac086a51fff8c10f15fc0891f1434
SHA196ea37bdfb2fcd833b25b786b9ba60708c21a6ba
SHA256e4e5b014acbfd8e5bb1c32bf68f36bf147eec5118acc56bc28bf231fc4b4d0ad
SHA512968361d707a068ddebf08f0aef24e82447823436ab404497dddceb11129fd7013b9f87d4168852d5ec6ff7746529b460ec75d9c815d263ed323117b09837132e
-
memory/768-13-0x0000000000000000-mapping.dmp
-
memory/1144-11-0x0000000004F80000-0x0000000004F81000-memory.dmpFilesize
4KB
-
memory/1144-12-0x0000000000B30000-0x0000000000B8C000-memory.dmpFilesize
368KB
-
memory/1144-7-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/1144-8-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/1144-9-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/1144-10-0x0000000005260000-0x0000000005263000-memory.dmpFilesize
12KB
-
memory/1144-2-0x0000000073450000-0x0000000073B3E000-memory.dmpFilesize
6.9MB
-
memory/1144-6-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/1144-5-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/1144-3-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/1288-15-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1288-16-0x000000000043749E-mapping.dmp
-
memory/1288-17-0x0000000073450000-0x0000000073B3E000-memory.dmpFilesize
6.9MB
-
memory/1288-22-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/1288-23-0x0000000005330000-0x0000000005331000-memory.dmpFilesize
4KB
-
memory/1288-24-0x0000000005AE0000-0x0000000005AE1000-memory.dmpFilesize
4KB