Analysis
-
max time kernel
149s -
max time network
69s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
19-04-2021 18:18
Static task
static1
Behavioral task
behavioral1
Sample
35742.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
35742.exe
Resource
win10v20210408
General
-
Target
35742.exe
-
Size
763KB
-
MD5
475f12cc2635e010575a69ea39b22968
-
SHA1
17ac5e0c5e50808d5bb495d63f478687fdd297ab
-
SHA256
51af0a175f8c7ef9d3e6b06b54ed1c8b4175f21ebac90816c6c36fd0e62ef654
-
SHA512
57be18e887239afd6290715cfd1df6c1afa2e2a6c360c7a7905ddffe13cb669624092b2adb3d2452d95b6c9b5502d2319d03e52bb4c704f291ab81042aa70854
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://45.141.152.18/ - Port:
21 - Username:
[email protected] - Password:
wTk4W1Uhkp5u
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1584-127-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/1584-128-0x000000000043760E-mapping.dmp family_agenttesla -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
35742.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\hZpzJs = "C:\\Users\\Admin\\AppData\\Roaming\\hZpzJs\\hZpzJs.exe" 35742.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
35742.exedescription pid process target process PID 604 set thread context of 1584 604 35742.exe 35742.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
35742.exe35742.exepid process 604 35742.exe 604 35742.exe 604 35742.exe 604 35742.exe 1584 35742.exe 1584 35742.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
35742.exepid process 1584 35742.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
35742.exe35742.exedescription pid process Token: SeDebugPrivilege 604 35742.exe Token: SeDebugPrivilege 1584 35742.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
35742.exedescription pid process target process PID 604 wrote to memory of 1340 604 35742.exe schtasks.exe PID 604 wrote to memory of 1340 604 35742.exe schtasks.exe PID 604 wrote to memory of 1340 604 35742.exe schtasks.exe PID 604 wrote to memory of 1584 604 35742.exe 35742.exe PID 604 wrote to memory of 1584 604 35742.exe 35742.exe PID 604 wrote to memory of 1584 604 35742.exe 35742.exe PID 604 wrote to memory of 1584 604 35742.exe 35742.exe PID 604 wrote to memory of 1584 604 35742.exe 35742.exe PID 604 wrote to memory of 1584 604 35742.exe 35742.exe PID 604 wrote to memory of 1584 604 35742.exe 35742.exe PID 604 wrote to memory of 1584 604 35742.exe 35742.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35742.exe"C:\Users\Admin\AppData\Local\Temp\35742.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rveyuOyOEbQqxH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF33A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\35742.exe"C:\Users\Admin\AppData\Local\Temp\35742.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF33A.tmpMD5
8138636c848e043db16892ac2dd3da32
SHA1e1ccfe3650e88194fac140a76a6618f62c037a5c
SHA256f10b1fc2491085caa434d867729a515dcae5a72c6f71d0c26281b98feed79f98
SHA512cf51b129bbdc53459ac99603fc2900e9ea54594864a94b13ee5365c3f80cf5476d82f5d187127978c74ea47d1fbc47cdf7778306cf9db9205a0bcd5ba1f3461e
-
memory/604-123-0x0000000007340000-0x00000000073C4000-memory.dmpFilesize
528KB
-
memory/604-122-0x0000000005620000-0x0000000005629000-memory.dmpFilesize
36KB
-
memory/604-118-0x00000000051C0000-0x00000000051C1000-memory.dmpFilesize
4KB
-
memory/604-119-0x0000000002BE0000-0x0000000002BE1000-memory.dmpFilesize
4KB
-
memory/604-124-0x0000000001120000-0x0000000001168000-memory.dmpFilesize
288KB
-
memory/604-121-0x0000000001300000-0x0000000001301000-memory.dmpFilesize
4KB
-
memory/604-117-0x00000000056C0000-0x00000000056C1000-memory.dmpFilesize
4KB
-
memory/604-114-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/604-120-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/604-116-0x0000000005120000-0x0000000005121000-memory.dmpFilesize
4KB
-
memory/1340-125-0x0000000000000000-mapping.dmp
-
memory/1584-127-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1584-128-0x000000000043760E-mapping.dmp
-
memory/1584-133-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB
-
memory/1584-134-0x00000000051B0000-0x00000000051B1000-memory.dmpFilesize
4KB
-
memory/1584-135-0x0000000005CE0000-0x0000000005CE1000-memory.dmpFilesize
4KB