Analysis
-
max time kernel
152s -
max time network
19s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
20-04-2021 05:41
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT COPY.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PAYMENT COPY.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
PAYMENT COPY.exe
-
Size
750KB
-
MD5
b7648b741ec8f6d9f882464f521a8aed
-
SHA1
78d4c91a87bf51c0495899a4ed4f3b89b3e6ba13
-
SHA256
f7f3e9fbe1bff8f404b8b150d016d2e1757f27756b4664da9ac4dcf7e9a6a09f
-
SHA512
2eb26d6e1e91f7547f8940a6082267768dd3222af7f8ebe25b69292e80692cde46daf913df6070e448352911498d2d582a1cfc9a974a49e25f938a2fa86914ac
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
a2plcpnl0347.prod.iad2.secureserver.net - Port:
587 - Username:
[email protected] - Password:
Admin_123
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1524-68-0x000000000043762E-mapping.dmp family_agenttesla behavioral1/memory/1524-67-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1524-69-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\AvrzbM = "C:\\Users\\Admin\\AppData\\Roaming\\AvrzbM\\AvrzbM.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PAYMENT COPY.exedescription pid process target process PID 1096 set thread context of 1524 1096 PAYMENT COPY.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
PAYMENT COPY.exeRegSvcs.exepid process 1096 PAYMENT COPY.exe 1096 PAYMENT COPY.exe 1096 PAYMENT COPY.exe 1524 RegSvcs.exe 1524 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PAYMENT COPY.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1096 PAYMENT COPY.exe Token: SeDebugPrivilege 1524 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PAYMENT COPY.exedescription pid process target process PID 1096 wrote to memory of 1524 1096 PAYMENT COPY.exe RegSvcs.exe PID 1096 wrote to memory of 1524 1096 PAYMENT COPY.exe RegSvcs.exe PID 1096 wrote to memory of 1524 1096 PAYMENT COPY.exe RegSvcs.exe PID 1096 wrote to memory of 1524 1096 PAYMENT COPY.exe RegSvcs.exe PID 1096 wrote to memory of 1524 1096 PAYMENT COPY.exe RegSvcs.exe PID 1096 wrote to memory of 1524 1096 PAYMENT COPY.exe RegSvcs.exe PID 1096 wrote to memory of 1524 1096 PAYMENT COPY.exe RegSvcs.exe PID 1096 wrote to memory of 1524 1096 PAYMENT COPY.exe RegSvcs.exe PID 1096 wrote to memory of 1524 1096 PAYMENT COPY.exe RegSvcs.exe PID 1096 wrote to memory of 1524 1096 PAYMENT COPY.exe RegSvcs.exe PID 1096 wrote to memory of 1524 1096 PAYMENT COPY.exe RegSvcs.exe PID 1096 wrote to memory of 1524 1096 PAYMENT COPY.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1096-60-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/1096-62-0x0000000004380000-0x0000000004381000-memory.dmpFilesize
4KB
-
memory/1096-63-0x0000000000640000-0x0000000000649000-memory.dmpFilesize
36KB
-
memory/1096-64-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1096-65-0x00000000053E0000-0x0000000005464000-memory.dmpFilesize
528KB
-
memory/1096-66-0x00000000042C0000-0x0000000004309000-memory.dmpFilesize
292KB
-
memory/1524-68-0x000000000043762E-mapping.dmp
-
memory/1524-67-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1524-69-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1524-71-0x0000000004870000-0x0000000004871000-memory.dmpFilesize
4KB