Analysis
-
max time kernel
146s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
19-04-2021 18:18
Static task
static1
Behavioral task
behavioral1
Sample
35742.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
35742.exe
Resource
win10v20210410
General
-
Target
35742.exe
-
Size
763KB
-
MD5
475f12cc2635e010575a69ea39b22968
-
SHA1
17ac5e0c5e50808d5bb495d63f478687fdd297ab
-
SHA256
51af0a175f8c7ef9d3e6b06b54ed1c8b4175f21ebac90816c6c36fd0e62ef654
-
SHA512
57be18e887239afd6290715cfd1df6c1afa2e2a6c360c7a7905ddffe13cb669624092b2adb3d2452d95b6c9b5502d2319d03e52bb4c704f291ab81042aa70854
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://45.141.152.18/ - Port:
21 - Username:
[email protected] - Password:
wTk4W1Uhkp5u
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/412-127-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/412-128-0x000000000043760E-mapping.dmp family_agenttesla behavioral2/memory/412-134-0x00000000051A0000-0x000000000569E000-memory.dmp family_agenttesla -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
35742.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\hZpzJs = "C:\\Users\\Admin\\AppData\\Roaming\\hZpzJs\\hZpzJs.exe" 35742.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
35742.exedescription pid process target process PID 3656 set thread context of 412 3656 35742.exe 35742.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
35742.exe35742.exepid process 3656 35742.exe 3656 35742.exe 3656 35742.exe 3656 35742.exe 412 35742.exe 412 35742.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
35742.exepid process 412 35742.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
35742.exe35742.exedescription pid process Token: SeDebugPrivilege 3656 35742.exe Token: SeDebugPrivilege 412 35742.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
35742.exedescription pid process target process PID 3656 wrote to memory of 740 3656 35742.exe schtasks.exe PID 3656 wrote to memory of 740 3656 35742.exe schtasks.exe PID 3656 wrote to memory of 740 3656 35742.exe schtasks.exe PID 3656 wrote to memory of 412 3656 35742.exe 35742.exe PID 3656 wrote to memory of 412 3656 35742.exe 35742.exe PID 3656 wrote to memory of 412 3656 35742.exe 35742.exe PID 3656 wrote to memory of 412 3656 35742.exe 35742.exe PID 3656 wrote to memory of 412 3656 35742.exe 35742.exe PID 3656 wrote to memory of 412 3656 35742.exe 35742.exe PID 3656 wrote to memory of 412 3656 35742.exe 35742.exe PID 3656 wrote to memory of 412 3656 35742.exe 35742.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35742.exe"C:\Users\Admin\AppData\Local\Temp\35742.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rveyuOyOEbQqxH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC545.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\35742.exe"C:\Users\Admin\AppData\Local\Temp\35742.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\35742.exe.logMD5
90acfd72f14a512712b1a7380c0faf60
SHA140ba4accb8faa75887e84fb8e38d598dc8cf0f12
SHA25620806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86
SHA51229dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9
-
C:\Users\Admin\AppData\Local\Temp\tmpC545.tmpMD5
8a14dc07732e0c779ad0336043a3b7af
SHA1a4902ccb6bd4169da4775337d5d1cc580a574834
SHA25603baa906db5affbdde548bd742550daf74f4c410c4242c3b3a710ef490862b88
SHA512dee331f45f9d90c9769d3814252909d1c3c2c96a3bd88acfb8b336d4c15c873770dc0edf31a2ae3ef7cca9f00f565a98dae6b1e3253e999ee5e1b549d5c37ba1
-
memory/412-136-0x0000000005E10000-0x0000000005E11000-memory.dmpFilesize
4KB
-
memory/412-135-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/412-134-0x00000000051A0000-0x000000000569E000-memory.dmpFilesize
5.0MB
-
memory/412-128-0x000000000043760E-mapping.dmp
-
memory/412-127-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/740-125-0x0000000000000000-mapping.dmp
-
memory/3656-119-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/3656-124-0x0000000000AE0000-0x0000000000B28000-memory.dmpFilesize
288KB
-
memory/3656-123-0x0000000006E00000-0x0000000006E84000-memory.dmpFilesize
528KB
-
memory/3656-122-0x0000000004970000-0x0000000004A0C000-memory.dmpFilesize
624KB
-
memory/3656-121-0x0000000004FC0000-0x0000000004FC9000-memory.dmpFilesize
36KB
-
memory/3656-120-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/3656-114-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/3656-118-0x0000000004B60000-0x0000000004B61000-memory.dmpFilesize
4KB
-
memory/3656-117-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/3656-116-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB