Analysis
-
max time kernel
145s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-02-2021 03:13
Static task
static1
Behavioral task
behavioral1
Sample
4019223246.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
4019223246.exe
Resource
win10v20201028
General
-
Target
4019223246.exe
-
Size
578KB
-
MD5
cbbc71d2c2f3e4fb43d79aa0c2286eb0
-
SHA1
83b3a1cb0e58d08e67de440aee069a6310ffbf05
-
SHA256
371a74d7e241249d2fca30e3d0b61c1d734e17a670bac95d88ae1793cf908f7e
-
SHA512
b2a9795ed6947318e96b6dfd6af3d8e7f1803917ef70f6119524966d5b0f00d93071595cc4fa4b890c0aca9712060fd33b8ffddbfd7735f02fc88af269bc4c2d
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
parida@1971@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1124-10-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1124-11-0x00000000004374EE-mapping.dmp family_agenttesla behavioral1/memory/1124-13-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4019223246.exedescription pid process target process PID 1724 set thread context of 1124 1724 4019223246.exe 4019223246.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4019223246.exepid process 1124 4019223246.exe 1124 4019223246.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4019223246.exedescription pid process Token: SeDebugPrivilege 1124 4019223246.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
4019223246.exedescription pid process target process PID 1724 wrote to memory of 1640 1724 4019223246.exe schtasks.exe PID 1724 wrote to memory of 1640 1724 4019223246.exe schtasks.exe PID 1724 wrote to memory of 1640 1724 4019223246.exe schtasks.exe PID 1724 wrote to memory of 1640 1724 4019223246.exe schtasks.exe PID 1724 wrote to memory of 1124 1724 4019223246.exe 4019223246.exe PID 1724 wrote to memory of 1124 1724 4019223246.exe 4019223246.exe PID 1724 wrote to memory of 1124 1724 4019223246.exe 4019223246.exe PID 1724 wrote to memory of 1124 1724 4019223246.exe 4019223246.exe PID 1724 wrote to memory of 1124 1724 4019223246.exe 4019223246.exe PID 1724 wrote to memory of 1124 1724 4019223246.exe 4019223246.exe PID 1724 wrote to memory of 1124 1724 4019223246.exe 4019223246.exe PID 1724 wrote to memory of 1124 1724 4019223246.exe 4019223246.exe PID 1724 wrote to memory of 1124 1724 4019223246.exe 4019223246.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4019223246.exe"C:\Users\Admin\AppData\Local\Temp\4019223246.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OogvJNZWDrsEN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC468.tmp"2⤵
- Creates scheduled task(s)
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\4019223246.exe"C:\Users\Admin\AppData\Local\Temp\4019223246.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1124
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC468.tmpMD5
1bb1bbc3839c1a50ff27fcb18bfffd9b
SHA142640f97444fd29b083627920659c4268a28fa38
SHA256a9a3933c87b5140f1c332946165984811199b980b898c0942e31391c3cab545b
SHA512cbe8a5899499031fd2887aadd838a08501684be1d70061b790206d26d66009e44dd2416e99dd18cf04e1faf97c21b3b1c13cc5f440f549fb6e936f4b6c6b372c
-
memory/1124-10-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1124-11-0x00000000004374EE-mapping.dmp
-
memory/1124-12-0x0000000074D20000-0x000000007540E000-memory.dmpFilesize
6.9MB
-
memory/1124-13-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1124-15-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/1640-8-0x0000000000000000-mapping.dmp
-
memory/1724-2-0x0000000074D20000-0x000000007540E000-memory.dmpFilesize
6.9MB
-
memory/1724-3-0x00000000009B0000-0x00000000009B1000-memory.dmpFilesize
4KB
-
memory/1724-5-0x00000000008E0000-0x00000000008E1000-memory.dmpFilesize
4KB
-
memory/1724-6-0x0000000000830000-0x0000000000833000-memory.dmpFilesize
12KB
-
memory/1724-7-0x00000000044B0000-0x000000000450C000-memory.dmpFilesize
368KB