Analysis

  • max time kernel
    147s
  • max time network
    111s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    08-04-2021 03:33

General

  • Target

    nunu.exe

  • Size

    507KB

  • MD5

    c7fa443b722dd4bffcda58dbd6a8ad71

  • SHA1

    d41111e463dfaa1c10a50f0a6a5d48fc8ae4f7e7

  • SHA256

    a321481a5f943697829963ca1ebfafb6f4857ee1af0119daf7c9e274d4e756a0

  • SHA512

    52e8a71c2214e5cde34a6ff055ee944bfc3d06f8dcb82b247a0d3ab02417bfb6a836457fb7de9e145de5be04a7805a1b61a197e0a48c92234de8e31c53ce12d2

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.dtvcambodia.com
  • Port:
    587
  • Username:
    leakkim@dtvcambodia.com
  • Password:
    @DTVcambodia2017

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload 2 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\nunu.exe
    "C:\Users\Admin\AppData\Local\Temp\nunu.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
        PID:4160
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        2⤵
        • Drops file in Drivers directory
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4176

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4176-15-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/4176-24-0x0000000005D40000-0x0000000005D41000-memory.dmp
      Filesize

      4KB

    • memory/4176-23-0x0000000005CB0000-0x0000000005CB1000-memory.dmp
      Filesize

      4KB

    • memory/4176-22-0x0000000005250000-0x0000000005251000-memory.dmp
      Filesize

      4KB

    • memory/4176-17-0x0000000073D60000-0x000000007444E000-memory.dmp
      Filesize

      6.9MB

    • memory/4176-16-0x000000000043764E-mapping.dmp
    • memory/4636-7-0x0000000005280000-0x0000000005281000-memory.dmp
      Filesize

      4KB

    • memory/4636-10-0x00000000054C0000-0x00000000054C1000-memory.dmp
      Filesize

      4KB

    • memory/4636-11-0x00000000056B0000-0x00000000056B4000-memory.dmp
      Filesize

      16KB

    • memory/4636-12-0x000000007FD00000-0x000000007FD01000-memory.dmp
      Filesize

      4KB

    • memory/4636-13-0x0000000001220000-0x0000000001291000-memory.dmp
      Filesize

      452KB

    • memory/4636-14-0x0000000000E40000-0x0000000000E7B000-memory.dmp
      Filesize

      236KB

    • memory/4636-9-0x00000000053E0000-0x00000000053E1000-memory.dmp
      Filesize

      4KB

    • memory/4636-8-0x00000000051C0000-0x00000000051C1000-memory.dmp
      Filesize

      4KB

    • memory/4636-2-0x0000000073D60000-0x000000007444E000-memory.dmp
      Filesize

      6.9MB

    • memory/4636-6-0x00000000056E0000-0x00000000056E1000-memory.dmp
      Filesize

      4KB

    • memory/4636-5-0x0000000005120000-0x0000000005121000-memory.dmp
      Filesize

      4KB

    • memory/4636-3-0x0000000000890000-0x0000000000891000-memory.dmp
      Filesize

      4KB