Analysis
- max time kernel
127s - max time network
111s - platform
windows10_x64 - resource
win10v20210410 - submitted
21/04/2021, 01:28
General
- Target Purchase Order_P2C017400.exe
- Size 1.1MB
- Sample210421-ct7vfgpdf6
- SHA256 f39980b6f513345fde2aad18cb790595c8cb64139cb0aa1686d6c4e7c8b24e2b
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
webmail.mdist.us
-
Port
587
-
Username
-
Password
Jg#4321
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 3 IoCs
- Drops file in Drivers directory 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order_P2C017400.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order_P2C017400.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DVvleQPYAJVS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA4D1.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2204-123-0x000000000E010000-0x000000000E07A000-memory.dmp
memory/2204-117-0x00000000073E0000-0x00000000073E1000-memory.dmp
memory/2204-119-0x0000000001060000-0x0000000001065000-memory.dmp
memory/2204-120-0x000000000A9E0000-0x000000000A9E1000-memory.dmp
memory/2204-121-0x0000000007340000-0x000000000783E000-memory.dmp
memory/2204-122-0x00000000090E0000-0x000000000918F000-memory.dmp
memory/2204-114-0x0000000000560000-0x0000000000561000-memory.dmp
memory/2204-118-0x0000000007380000-0x0000000007381000-memory.dmp
memory/2204-116-0x0000000007840000-0x0000000007841000-memory.dmp
memory/2656-126-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2656-132-0x0000000004E40000-0x000000000533E000-memory.dmp
memory/2656-133-0x0000000004FF0000-0x0000000004FF1000-memory.dmp
memory/2656-134-0x0000000005AA0000-0x0000000005AA1000-memory.dmp