Analysis
-
max time kernel
147s -
max time network
97s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-02-2021 15:16
Static task
static1
Behavioral task
behavioral1
Sample
BuXml0xOJlFXusF.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
BuXml0xOJlFXusF.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
BuXml0xOJlFXusF.exe
-
Size
551KB
-
MD5
2b83697e842ccf54a72b2ca68f44947b
-
SHA1
b7aacc8139ee8c4d74b507c1435e0fb04d6a0a99
-
SHA256
62b54609bea9a6af4f71daa41bfaeb75235f662d608480020257a9eba7255dd4
-
SHA512
d3028843f5a46344379a1915bb0eaa0850571778ae5b763fa1c8de1e065ff165fdd78a6327076768b46921266e27c7720c157ab80b79b3ca1cc7fe1cdec38da0
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.iymorenterprizelogs.com - Port:
587 - Username:
[email protected] - Password:
nxLq9soWurW3
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1052-9-0x00000000004375EE-mapping.dmp family_agenttesla behavioral1/memory/1052-8-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1052-11-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BuXml0xOJlFXusF.exedescription pid process target process PID 2008 set thread context of 1052 2008 BuXml0xOJlFXusF.exe BuXml0xOJlFXusF.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
BuXml0xOJlFXusF.exepid process 1052 BuXml0xOJlFXusF.exe 1052 BuXml0xOJlFXusF.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
BuXml0xOJlFXusF.exedescription pid process Token: SeDebugPrivilege 1052 BuXml0xOJlFXusF.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
BuXml0xOJlFXusF.exedescription pid process target process PID 2008 wrote to memory of 1052 2008 BuXml0xOJlFXusF.exe BuXml0xOJlFXusF.exe PID 2008 wrote to memory of 1052 2008 BuXml0xOJlFXusF.exe BuXml0xOJlFXusF.exe PID 2008 wrote to memory of 1052 2008 BuXml0xOJlFXusF.exe BuXml0xOJlFXusF.exe PID 2008 wrote to memory of 1052 2008 BuXml0xOJlFXusF.exe BuXml0xOJlFXusF.exe PID 2008 wrote to memory of 1052 2008 BuXml0xOJlFXusF.exe BuXml0xOJlFXusF.exe PID 2008 wrote to memory of 1052 2008 BuXml0xOJlFXusF.exe BuXml0xOJlFXusF.exe PID 2008 wrote to memory of 1052 2008 BuXml0xOJlFXusF.exe BuXml0xOJlFXusF.exe PID 2008 wrote to memory of 1052 2008 BuXml0xOJlFXusF.exe BuXml0xOJlFXusF.exe PID 2008 wrote to memory of 1052 2008 BuXml0xOJlFXusF.exe BuXml0xOJlFXusF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BuXml0xOJlFXusF.exe"C:\Users\Admin\AppData\Local\Temp\BuXml0xOJlFXusF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BuXml0xOJlFXusF.exe"C:\Users\Admin\AppData\Local\Temp\BuXml0xOJlFXusF.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1052-9-0x00000000004375EE-mapping.dmp
-
memory/1052-8-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1052-10-0x0000000074BA0000-0x000000007528E000-memory.dmpFilesize
6.9MB
-
memory/1052-11-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1052-13-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/2008-2-0x0000000074BA0000-0x000000007528E000-memory.dmpFilesize
6.9MB
-
memory/2008-3-0x0000000000E00000-0x0000000000E01000-memory.dmpFilesize
4KB
-
memory/2008-5-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/2008-6-0x0000000000550000-0x0000000000553000-memory.dmpFilesize
12KB
-
memory/2008-7-0x0000000005000000-0x000000000505C000-memory.dmpFilesize
368KB