Analysis
-
max time kernel
151s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
21-04-2021 13:37
Static task
static1
Behavioral task
behavioral1
Sample
ecfd2213123a0a0e27c0530e35c7fa2f.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
ecfd2213123a0a0e27c0530e35c7fa2f.exe
Resource
win10v20210408
General
-
Target
ecfd2213123a0a0e27c0530e35c7fa2f.exe
-
Size
804KB
-
MD5
ecfd2213123a0a0e27c0530e35c7fa2f
-
SHA1
3dd5d3ff83acecfab13ae1790d5a8b553c88bda2
-
SHA256
89b7ce8de53ccf4aff814e942aa9042022e4644520a09ee1b0b13a429d552ea1
-
SHA512
46b25a93b4db7695e9706f7f213aed9caeee48d4c397bf366b7b31d6f43bdbc2fa785c39f1ad0d543e181984eb0e6516757f90efdc5dc355576eeaaf1ffa5ab9
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
sales@julislinq.com - Password:
27!iaL@!U@L5Ma
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1284-126-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/1284-127-0x00000000004375EE-mapping.dmp family_agenttesla -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ecfd2213123a0a0e27c0530e35c7fa2f.exedescription pid process target process PID 4044 set thread context of 1284 4044 ecfd2213123a0a0e27c0530e35c7fa2f.exe ecfd2213123a0a0e27c0530e35c7fa2f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ecfd2213123a0a0e27c0530e35c7fa2f.exepid process 1284 ecfd2213123a0a0e27c0530e35c7fa2f.exe 1284 ecfd2213123a0a0e27c0530e35c7fa2f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ecfd2213123a0a0e27c0530e35c7fa2f.exedescription pid process Token: SeDebugPrivilege 1284 ecfd2213123a0a0e27c0530e35c7fa2f.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
ecfd2213123a0a0e27c0530e35c7fa2f.exedescription pid process target process PID 4044 wrote to memory of 2008 4044 ecfd2213123a0a0e27c0530e35c7fa2f.exe schtasks.exe PID 4044 wrote to memory of 2008 4044 ecfd2213123a0a0e27c0530e35c7fa2f.exe schtasks.exe PID 4044 wrote to memory of 2008 4044 ecfd2213123a0a0e27c0530e35c7fa2f.exe schtasks.exe PID 4044 wrote to memory of 1284 4044 ecfd2213123a0a0e27c0530e35c7fa2f.exe ecfd2213123a0a0e27c0530e35c7fa2f.exe PID 4044 wrote to memory of 1284 4044 ecfd2213123a0a0e27c0530e35c7fa2f.exe ecfd2213123a0a0e27c0530e35c7fa2f.exe PID 4044 wrote to memory of 1284 4044 ecfd2213123a0a0e27c0530e35c7fa2f.exe ecfd2213123a0a0e27c0530e35c7fa2f.exe PID 4044 wrote to memory of 1284 4044 ecfd2213123a0a0e27c0530e35c7fa2f.exe ecfd2213123a0a0e27c0530e35c7fa2f.exe PID 4044 wrote to memory of 1284 4044 ecfd2213123a0a0e27c0530e35c7fa2f.exe ecfd2213123a0a0e27c0530e35c7fa2f.exe PID 4044 wrote to memory of 1284 4044 ecfd2213123a0a0e27c0530e35c7fa2f.exe ecfd2213123a0a0e27c0530e35c7fa2f.exe PID 4044 wrote to memory of 1284 4044 ecfd2213123a0a0e27c0530e35c7fa2f.exe ecfd2213123a0a0e27c0530e35c7fa2f.exe PID 4044 wrote to memory of 1284 4044 ecfd2213123a0a0e27c0530e35c7fa2f.exe ecfd2213123a0a0e27c0530e35c7fa2f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecfd2213123a0a0e27c0530e35c7fa2f.exe"C:\Users\Admin\AppData\Local\Temp\ecfd2213123a0a0e27c0530e35c7fa2f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sGRCdRKHCW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1250.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ecfd2213123a0a0e27c0530e35c7fa2f.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ecfd2213123a0a0e27c0530e35c7fa2f.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
C:\Users\Admin\AppData\Local\Temp\tmp1250.tmpMD5
b90849f4f0d12ccb928d4805955b8aa0
SHA12e7d0719361d603dbb4b1233aaf6f3be59607b64
SHA2569e856b23cdb00a5708b29a129ea3c6fe44bd0345448d9e470a6670be4af6162a
SHA5120961ef246b8ca8ae3074333439ee1c64d37326ac6f8bcdaded2bbce59c0e35229b16ffb64bb418a7a20a5c67daaf03edea165cfc3826bbea87acda14dcdf2f2a
-
memory/1284-135-0x0000000006450000-0x0000000006451000-memory.dmpFilesize
4KB
-
memory/1284-134-0x0000000005C70000-0x0000000005C71000-memory.dmpFilesize
4KB
-
memory/1284-133-0x00000000056D0000-0x00000000056D1000-memory.dmpFilesize
4KB
-
memory/1284-127-0x00000000004375EE-mapping.dmp
-
memory/1284-126-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2008-124-0x0000000000000000-mapping.dmp
-
memory/4044-119-0x0000000005330000-0x0000000005331000-memory.dmpFilesize
4KB
-
memory/4044-123-0x0000000009EC0000-0x0000000009F4C000-memory.dmpFilesize
560KB
-
memory/4044-122-0x00000000077F0000-0x00000000078BB000-memory.dmpFilesize
812KB
-
memory/4044-121-0x0000000005760000-0x000000000576E000-memory.dmpFilesize
56KB
-
memory/4044-120-0x00000000075A0000-0x00000000075A1000-memory.dmpFilesize
4KB
-
memory/4044-114-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/4044-118-0x0000000005270000-0x000000000576E000-memory.dmpFilesize
5.0MB
-
memory/4044-117-0x00000000051C0000-0x00000000051C1000-memory.dmpFilesize
4KB
-
memory/4044-116-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB