Analysis
-
max time kernel
143s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-04-2021 13:07
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT COPY...exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SWIFT COPY...exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
SWIFT COPY...exe
-
Size
599KB
-
MD5
aa3612d93d196644dd0f5a621727097b
-
SHA1
c67786490f9a2861d77518a0ca0ede5b5d2a97b6
-
SHA256
dc5b9ef8c3fcb0363be6ea97f1c887d9d346f2af506b6c818835d7f0d2e511f4
-
SHA512
cbe495818ea96c0497fda29a29f51729026f76beec1f0719db1bc53514ea70e33c6ac3bb732480e9956c457ab89c8da0a70f9a140452ba34ac9a692cc5c133d4
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
a2plcpnl0347.prod.iad2.secureserver.net - Port:
587 - Username:
clifford@eximindiacorporation.com - Password:
Admin_123
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1348-125-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/1348-126-0x000000000043762E-mapping.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
RegSvcs.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\AvrzbM = "C:\\Users\\Admin\\AppData\\Roaming\\AvrzbM\\AvrzbM.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SWIFT COPY...exedescription pid process target process PID 3992 set thread context of 1348 3992 SWIFT COPY...exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
SWIFT COPY...exeRegSvcs.exepid process 3992 SWIFT COPY...exe 3992 SWIFT COPY...exe 3992 SWIFT COPY...exe 3992 SWIFT COPY...exe 3992 SWIFT COPY...exe 3992 SWIFT COPY...exe 1348 RegSvcs.exe 1348 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SWIFT COPY...exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 3992 SWIFT COPY...exe Token: SeDebugPrivilege 1348 RegSvcs.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
SWIFT COPY...exedescription pid process target process PID 3992 wrote to memory of 2252 3992 SWIFT COPY...exe RegSvcs.exe PID 3992 wrote to memory of 2252 3992 SWIFT COPY...exe RegSvcs.exe PID 3992 wrote to memory of 2252 3992 SWIFT COPY...exe RegSvcs.exe PID 3992 wrote to memory of 1348 3992 SWIFT COPY...exe RegSvcs.exe PID 3992 wrote to memory of 1348 3992 SWIFT COPY...exe RegSvcs.exe PID 3992 wrote to memory of 1348 3992 SWIFT COPY...exe RegSvcs.exe PID 3992 wrote to memory of 1348 3992 SWIFT COPY...exe RegSvcs.exe PID 3992 wrote to memory of 1348 3992 SWIFT COPY...exe RegSvcs.exe PID 3992 wrote to memory of 1348 3992 SWIFT COPY...exe RegSvcs.exe PID 3992 wrote to memory of 1348 3992 SWIFT COPY...exe RegSvcs.exe PID 3992 wrote to memory of 1348 3992 SWIFT COPY...exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SWIFT COPY...exe"C:\Users\Admin\AppData\Local\Temp\SWIFT COPY...exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1348-125-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1348-133-0x0000000006180000-0x0000000006181000-memory.dmpFilesize
4KB
-
memory/1348-132-0x00000000060E0000-0x00000000060E1000-memory.dmpFilesize
4KB
-
memory/1348-131-0x0000000005450000-0x0000000005451000-memory.dmpFilesize
4KB
-
memory/1348-126-0x000000000043762E-mapping.dmp
-
memory/3992-121-0x0000000005440000-0x0000000005449000-memory.dmpFilesize
36KB
-
memory/3992-114-0x0000000000540000-0x0000000000541000-memory.dmpFilesize
4KB
-
memory/3992-122-0x000000007E610000-0x000000007E611000-memory.dmpFilesize
4KB
-
memory/3992-123-0x0000000000DE0000-0x0000000000E56000-memory.dmpFilesize
472KB
-
memory/3992-124-0x00000000080F0000-0x000000000812C000-memory.dmpFilesize
240KB
-
memory/3992-120-0x0000000004DA0000-0x0000000004E32000-memory.dmpFilesize
584KB
-
memory/3992-119-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/3992-118-0x0000000004EE0000-0x0000000004EE1000-memory.dmpFilesize
4KB
-
memory/3992-117-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB
-
memory/3992-116-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB