General
-
Target
PO - CE AUSTRALIA PTY LTD.ppam.zip
-
Size
9KB
-
Sample
210428-csmgr8bxe2
-
MD5
fe03dc39490fd2cdb1a42b3be4afaadc
-
SHA1
44b233b7735bfc99551844ea886ec90d544f2520
-
SHA256
0e9423c6b3d555a01513b11f32ab37696a240a469b496b64c01069c40e636447
-
SHA512
11f2029261380b855c4198b57faf55a6b02880b34c4295183e3da0b7d1b7abf19a237afb09a167b1d882f881e959f67332d7c44e67f7cd4838c3fde359997c9a
Static task
static1
Behavioral task
behavioral1
Sample
PO - CE AUSTRALIA PTY LTD.ppam
Resource
win7v20210410
Behavioral task
behavioral2
Sample
PO - CE AUSTRALIA PTY LTD.ppam
Resource
win10v20210408
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G2KS51P3\5940e4_39e7aca5ca73408f9ea38510ed3aa48e[1].txt
ryuk
Extracted
agenttesla
http://103.133.105.179/1919/inc/d08414f02917b7.php
Targets
-
-
Target
PO - CE AUSTRALIA PTY LTD.ppam
-
Size
10KB
-
MD5
7c629522213c57c3b3d66ee8e6c13fed
-
SHA1
352b55636c67a5cd27a998888df0a137ef5433d8
-
SHA256
a2e98dd3fa146e70b06e95d0cbbf9a831a04e94572a229e6d554372cb6943c04
-
SHA512
385fbe8c518741e20daf5a62ac6e772d9d7b813e53e2a02b75f32287711c5ca316e162d24b04f48c1a90d799314f330fdc564a3494a27fa3811c1eb87571563b
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
AgentTesla Payload
-
XMRig Miner Payload
-
Blocklisted process makes network request
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-