4HwMTLRFvpnRf2a.exe

General
Target

4HwMTLRFvpnRf2a.exe

Filesize

2MB

Completed

04-05-2021 15:06

Score
10 /10
MD5

ec835ba0c96c625b726e90871fa4408e

SHA1

f4f79d8c5d99dd6435f72bcf9c1d90aab96e47ab

SHA256

6a156918ff4ace56113e28bfc878aab413d3021fc89f0e6dad59744ac25874fe

Malware Config

Extracted

Family agenttesla
Credentials

Protocol: smtp

Host: mail.fariya.com

Port: 587

Username: agha@fariya.com

Password: password2017

Signatures 8

Filter: none

Discovery
Persistence
  • AgentTesla

    Description

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla Payload

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/1876-127-0x0000000000400000-0x000000000043C000-memory.dmpfamily_agenttesla
    behavioral2/memory/1876-128-0x000000000043760E-mapping.dmpfamily_agenttesla
    behavioral2/memory/1876-134-0x00000000052C0000-0x00000000057BE000-memory.dmpfamily_agenttesla
  • Suspicious use of SetThreadContext
    4HwMTLRFvpnRf2a.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4040 set thread context of 187640404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    2116schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    4HwMTLRFvpnRf2a.exe

    Reported IOCs

    pidprocess
    18764HwMTLRFvpnRf2a.exe
    18764HwMTLRFvpnRf2a.exe
  • Suspicious use of AdjustPrivilegeToken
    4HwMTLRFvpnRf2a.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege18764HwMTLRFvpnRf2a.exe
  • Suspicious use of WriteProcessMemory
    4HwMTLRFvpnRf2a.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4040 wrote to memory of 211640404HwMTLRFvpnRf2a.exeschtasks.exe
    PID 4040 wrote to memory of 211640404HwMTLRFvpnRf2a.exeschtasks.exe
    PID 4040 wrote to memory of 211640404HwMTLRFvpnRf2a.exeschtasks.exe
    PID 4040 wrote to memory of 187640404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 4040 wrote to memory of 187640404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 4040 wrote to memory of 187640404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 4040 wrote to memory of 187640404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 4040 wrote to memory of 187640404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 4040 wrote to memory of 187640404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 4040 wrote to memory of 187640404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
    PID 4040 wrote to memory of 187640404HwMTLRFvpnRf2a.exe4HwMTLRFvpnRf2a.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe
    "C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:4040
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UXnYcxbuH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB278.tmp"
      Creates scheduled task(s)
      PID:2116
    • C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe
      "C:\Users\Admin\AppData\Local\Temp\4HwMTLRFvpnRf2a.exe"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1876
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4HwMTLRFvpnRf2a.exe.log

                        MD5

                        90acfd72f14a512712b1a7380c0faf60

                        SHA1

                        40ba4accb8faa75887e84fb8e38d598dc8cf0f12

                        SHA256

                        20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86

                        SHA512

                        29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9

                      • C:\Users\Admin\AppData\Local\Temp\tmpB278.tmp

                        MD5

                        439028074dead0efe98e1a03f37a2389

                        SHA1

                        994ceed5c1641e5c71fc23a0697b7da871fa6992

                        SHA256

                        8739cdbfb02a91be27cb1237f29af9066b4c6b33a937d430bfc7e1d5224ad484

                        SHA512

                        e4556893f31d27e9bd6878e0d8f3ca4569409d92663de35b656b0faebaef0a83fd2ab005c06b732127ce8e41dd192ec7f6f745f19168a58f2fe6521ad4869b79

                      • memory/1876-135-0x0000000005720000-0x0000000005721000-memory.dmp

                      • memory/1876-134-0x00000000052C0000-0x00000000057BE000-memory.dmp

                      • memory/1876-128-0x000000000043760E-mapping.dmp

                      • memory/1876-127-0x0000000000400000-0x000000000043C000-memory.dmp

                      • memory/1876-136-0x0000000005EB0000-0x0000000005EB1000-memory.dmp

                      • memory/2116-125-0x0000000000000000-mapping.dmp

                      • memory/4040-124-0x0000000008680000-0x00000000086BE000-memory.dmp

                      • memory/4040-123-0x0000000001460000-0x00000000014DC000-memory.dmp

                      • memory/4040-122-0x00000000056C0000-0x00000000056CE000-memory.dmp

                      • memory/4040-121-0x0000000005490000-0x000000000598E000-memory.dmp

                      • memory/4040-120-0x00000000055D0000-0x00000000055D1000-memory.dmp

                      • memory/4040-119-0x0000000005420000-0x0000000005421000-memory.dmp

                      • memory/4040-118-0x0000000005530000-0x0000000005531000-memory.dmp

                      • memory/4040-117-0x0000000005990000-0x0000000005991000-memory.dmp

                      • memory/4040-116-0x0000000005360000-0x0000000005361000-memory.dmp

                      • memory/4040-114-0x0000000000930000-0x0000000000931000-memory.dmp