Analysis
-
max time kernel
146s -
max time network
85s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
21-04-2021 13:48
Static task
static1
Behavioral task
behavioral1
Sample
3611d9cefc06c8c111f2e6ffc961e529.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
3611d9cefc06c8c111f2e6ffc961e529.exe
Resource
win10v20210410
General
-
Target
3611d9cefc06c8c111f2e6ffc961e529.exe
-
Size
1.1MB
-
MD5
3611d9cefc06c8c111f2e6ffc961e529
-
SHA1
dbf7420d6f21993ede19e6549a1c6f43541631ab
-
SHA256
3584183ec5e40f74913b0c7a89c6e8d2256d51df3743a59f64bef89f5cdefa7e
-
SHA512
714f0faa4d53dc71d40f2c91ffd5a3164b1a4ae4a2ee33643bee1de502523da3ced74e166a4dcf5b2504b66e9e96db73bdfb26c33b53c4d53ffbb026e6016ef7
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1620445910:AAF2v81NoINJsu_XXnpGet1YDm-NxnznaIE/sendDocument
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/908-66-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/908-67-0x000000000043764E-mapping.dmp family_agenttesla behavioral1/memory/908-68-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3611d9cefc06c8c111f2e6ffc961e529.exedescription pid process target process PID 1652 set thread context of 908 1652 3611d9cefc06c8c111f2e6ffc961e529.exe 3611d9cefc06c8c111f2e6ffc961e529.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
3611d9cefc06c8c111f2e6ffc961e529.exe3611d9cefc06c8c111f2e6ffc961e529.exepid process 1652 3611d9cefc06c8c111f2e6ffc961e529.exe 1652 3611d9cefc06c8c111f2e6ffc961e529.exe 1652 3611d9cefc06c8c111f2e6ffc961e529.exe 908 3611d9cefc06c8c111f2e6ffc961e529.exe 908 3611d9cefc06c8c111f2e6ffc961e529.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3611d9cefc06c8c111f2e6ffc961e529.exe3611d9cefc06c8c111f2e6ffc961e529.exedescription pid process Token: SeDebugPrivilege 1652 3611d9cefc06c8c111f2e6ffc961e529.exe Token: SeDebugPrivilege 908 3611d9cefc06c8c111f2e6ffc961e529.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
3611d9cefc06c8c111f2e6ffc961e529.exedescription pid process target process PID 1652 wrote to memory of 1032 1652 3611d9cefc06c8c111f2e6ffc961e529.exe 3611d9cefc06c8c111f2e6ffc961e529.exe PID 1652 wrote to memory of 1032 1652 3611d9cefc06c8c111f2e6ffc961e529.exe 3611d9cefc06c8c111f2e6ffc961e529.exe PID 1652 wrote to memory of 1032 1652 3611d9cefc06c8c111f2e6ffc961e529.exe 3611d9cefc06c8c111f2e6ffc961e529.exe PID 1652 wrote to memory of 1032 1652 3611d9cefc06c8c111f2e6ffc961e529.exe 3611d9cefc06c8c111f2e6ffc961e529.exe PID 1652 wrote to memory of 908 1652 3611d9cefc06c8c111f2e6ffc961e529.exe 3611d9cefc06c8c111f2e6ffc961e529.exe PID 1652 wrote to memory of 908 1652 3611d9cefc06c8c111f2e6ffc961e529.exe 3611d9cefc06c8c111f2e6ffc961e529.exe PID 1652 wrote to memory of 908 1652 3611d9cefc06c8c111f2e6ffc961e529.exe 3611d9cefc06c8c111f2e6ffc961e529.exe PID 1652 wrote to memory of 908 1652 3611d9cefc06c8c111f2e6ffc961e529.exe 3611d9cefc06c8c111f2e6ffc961e529.exe PID 1652 wrote to memory of 908 1652 3611d9cefc06c8c111f2e6ffc961e529.exe 3611d9cefc06c8c111f2e6ffc961e529.exe PID 1652 wrote to memory of 908 1652 3611d9cefc06c8c111f2e6ffc961e529.exe 3611d9cefc06c8c111f2e6ffc961e529.exe PID 1652 wrote to memory of 908 1652 3611d9cefc06c8c111f2e6ffc961e529.exe 3611d9cefc06c8c111f2e6ffc961e529.exe PID 1652 wrote to memory of 908 1652 3611d9cefc06c8c111f2e6ffc961e529.exe 3611d9cefc06c8c111f2e6ffc961e529.exe PID 1652 wrote to memory of 908 1652 3611d9cefc06c8c111f2e6ffc961e529.exe 3611d9cefc06c8c111f2e6ffc961e529.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3611d9cefc06c8c111f2e6ffc961e529.exe"C:\Users\Admin\AppData\Local\Temp\3611d9cefc06c8c111f2e6ffc961e529.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3611d9cefc06c8c111f2e6ffc961e529.exe"C:\Users\Admin\AppData\Local\Temp\3611d9cefc06c8c111f2e6ffc961e529.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3611d9cefc06c8c111f2e6ffc961e529.exe"C:\Users\Admin\AppData\Local\Temp\3611d9cefc06c8c111f2e6ffc961e529.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/908-66-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/908-67-0x000000000043764E-mapping.dmp
-
memory/908-68-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/908-70-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/1652-60-0x00000000009C0000-0x00000000009C1000-memory.dmpFilesize
4KB
-
memory/1652-62-0x00000000003E0000-0x00000000003E9000-memory.dmpFilesize
36KB
-
memory/1652-63-0x0000000004F60000-0x0000000004F61000-memory.dmpFilesize
4KB
-
memory/1652-64-0x0000000004740000-0x00000000047B8000-memory.dmpFilesize
480KB
-
memory/1652-65-0x00000000005F0000-0x000000000062C000-memory.dmpFilesize
240KB