Analysis
-
max time kernel
134s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-02-2021 14:42
Static task
static1
Behavioral task
behavioral1
Sample
9a041438adec53ed9e8f6ed3b2eb709b.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
9a041438adec53ed9e8f6ed3b2eb709b.exe
Resource
win10v20201028
General
-
Target
9a041438adec53ed9e8f6ed3b2eb709b.exe
-
Size
661KB
-
MD5
9a041438adec53ed9e8f6ed3b2eb709b
-
SHA1
dbabb8cb2b96c4e4cc4006084ebd3918e48c5cfb
-
SHA256
bb8889ec467fc276ee609b20f9f321dbd97b0bdba919bbf9e38f7d8d7517ed2b
-
SHA512
4766bf1e508b0397f8b936a5a1b8fef2b63091f2b204953c32a4db4b80dd8624c77d58500f1b003bb0d888296d7156ce9ff5b0298843ee4b4501895e4c30cbe6
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.konokonozanzibar.com - Port:
587 - Username:
[email protected] - Password:
Kk20@All
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/872-10-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/872-11-0x000000000043760E-mapping.dmp family_agenttesla behavioral1/memory/872-13-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
9a041438adec53ed9e8f6ed3b2eb709b.exedescription pid process target process PID 1640 set thread context of 872 1640 9a041438adec53ed9e8f6ed3b2eb709b.exe 9a041438adec53ed9e8f6ed3b2eb709b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
9a041438adec53ed9e8f6ed3b2eb709b.exepid process 872 9a041438adec53ed9e8f6ed3b2eb709b.exe 872 9a041438adec53ed9e8f6ed3b2eb709b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9a041438adec53ed9e8f6ed3b2eb709b.exedescription pid process Token: SeDebugPrivilege 872 9a041438adec53ed9e8f6ed3b2eb709b.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
9a041438adec53ed9e8f6ed3b2eb709b.exepid process 872 9a041438adec53ed9e8f6ed3b2eb709b.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
9a041438adec53ed9e8f6ed3b2eb709b.exedescription pid process target process PID 1640 wrote to memory of 1568 1640 9a041438adec53ed9e8f6ed3b2eb709b.exe schtasks.exe PID 1640 wrote to memory of 1568 1640 9a041438adec53ed9e8f6ed3b2eb709b.exe schtasks.exe PID 1640 wrote to memory of 1568 1640 9a041438adec53ed9e8f6ed3b2eb709b.exe schtasks.exe PID 1640 wrote to memory of 1568 1640 9a041438adec53ed9e8f6ed3b2eb709b.exe schtasks.exe PID 1640 wrote to memory of 872 1640 9a041438adec53ed9e8f6ed3b2eb709b.exe 9a041438adec53ed9e8f6ed3b2eb709b.exe PID 1640 wrote to memory of 872 1640 9a041438adec53ed9e8f6ed3b2eb709b.exe 9a041438adec53ed9e8f6ed3b2eb709b.exe PID 1640 wrote to memory of 872 1640 9a041438adec53ed9e8f6ed3b2eb709b.exe 9a041438adec53ed9e8f6ed3b2eb709b.exe PID 1640 wrote to memory of 872 1640 9a041438adec53ed9e8f6ed3b2eb709b.exe 9a041438adec53ed9e8f6ed3b2eb709b.exe PID 1640 wrote to memory of 872 1640 9a041438adec53ed9e8f6ed3b2eb709b.exe 9a041438adec53ed9e8f6ed3b2eb709b.exe PID 1640 wrote to memory of 872 1640 9a041438adec53ed9e8f6ed3b2eb709b.exe 9a041438adec53ed9e8f6ed3b2eb709b.exe PID 1640 wrote to memory of 872 1640 9a041438adec53ed9e8f6ed3b2eb709b.exe 9a041438adec53ed9e8f6ed3b2eb709b.exe PID 1640 wrote to memory of 872 1640 9a041438adec53ed9e8f6ed3b2eb709b.exe 9a041438adec53ed9e8f6ed3b2eb709b.exe PID 1640 wrote to memory of 872 1640 9a041438adec53ed9e8f6ed3b2eb709b.exe 9a041438adec53ed9e8f6ed3b2eb709b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a041438adec53ed9e8f6ed3b2eb709b.exe"C:\Users\Admin\AppData\Local\Temp\9a041438adec53ed9e8f6ed3b2eb709b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\evmcsxVj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9222.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\9a041438adec53ed9e8f6ed3b2eb709b.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9222.tmpMD5
2af8ee541eece64e51c1ecc776414f72
SHA1d692244df7125735b6271c53fce24298bd3c5a78
SHA25677d7a1396464b35ddc062ba15764b1bb2b2f276d6c3bad0fbabe2c70ba9591b5
SHA51255337d4ab0d7ab6d4adb2e01c13be2aaa6e17721c19b90719ae2549432e7a2349b4478d20f28190d5f6a89dba509024e006217aa2bb2bc922de249e1d0dac093
-
memory/872-12-0x00000000746F0000-0x0000000074DDE000-memory.dmpFilesize
6.9MB
-
memory/872-10-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/872-11-0x000000000043760E-mapping.dmp
-
memory/872-13-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/872-15-0x0000000000A20000-0x0000000000A21000-memory.dmpFilesize
4KB
-
memory/872-16-0x0000000000A21000-0x0000000000A22000-memory.dmpFilesize
4KB
-
memory/1568-8-0x0000000000000000-mapping.dmp
-
memory/1640-5-0x0000000004550000-0x0000000004551000-memory.dmpFilesize
4KB
-
memory/1640-6-0x0000000000480000-0x000000000048B000-memory.dmpFilesize
44KB
-
memory/1640-7-0x0000000005010000-0x0000000005096000-memory.dmpFilesize
536KB
-
memory/1640-3-0x0000000000F30000-0x0000000000F31000-memory.dmpFilesize
4KB
-
memory/1640-2-0x00000000746F0000-0x0000000074DDE000-memory.dmpFilesize
6.9MB