Analysis
-
max time kernel
126s -
max time network
17s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
04-05-2021 14:14
Static task
static1
Behavioral task
behavioral1
Sample
Ll2LxWOagynlSgJ.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Ll2LxWOagynlSgJ.exe
Resource
win10v20210410
General
-
Target
Ll2LxWOagynlSgJ.exe
-
Size
674KB
-
MD5
9dfaa6afc47f0bf01155b7f8253f719b
-
SHA1
0e82d1395e219ed0400959e6315675fdd03f0a54
-
SHA256
fd0be553157fca2a0a5f4cc559d95a3d6ec4b27b6f1368cad25997cac0ccac8f
-
SHA512
95f379a10ffd895be1b653dfb32227be31764c13ce75f35f21be6472045e385bb0aca718a6a1b0c57158c1449094b409c3192f19c47900e2d3829588b9980e2e
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.nilkarnal.com - Port:
587 - Username:
logs@nilkarnal.com - Password:
company1960
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1840-71-0x00000000004375FE-mapping.dmp family_agenttesla behavioral1/memory/1840-70-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1840-72-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Ll2LxWOagynlSgJ.exedescription pid process target process PID 1652 set thread context of 1840 1652 Ll2LxWOagynlSgJ.exe Ll2LxWOagynlSgJ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Ll2LxWOagynlSgJ.exeLl2LxWOagynlSgJ.exepid process 1652 Ll2LxWOagynlSgJ.exe 1652 Ll2LxWOagynlSgJ.exe 1840 Ll2LxWOagynlSgJ.exe 1840 Ll2LxWOagynlSgJ.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Ll2LxWOagynlSgJ.exeLl2LxWOagynlSgJ.exedescription pid process Token: SeDebugPrivilege 1652 Ll2LxWOagynlSgJ.exe Token: SeDebugPrivilege 1840 Ll2LxWOagynlSgJ.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Ll2LxWOagynlSgJ.exepid process 1652 Ll2LxWOagynlSgJ.exe 1652 Ll2LxWOagynlSgJ.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Ll2LxWOagynlSgJ.exedescription pid process target process PID 1652 wrote to memory of 564 1652 Ll2LxWOagynlSgJ.exe schtasks.exe PID 1652 wrote to memory of 564 1652 Ll2LxWOagynlSgJ.exe schtasks.exe PID 1652 wrote to memory of 564 1652 Ll2LxWOagynlSgJ.exe schtasks.exe PID 1652 wrote to memory of 564 1652 Ll2LxWOagynlSgJ.exe schtasks.exe PID 1652 wrote to memory of 1636 1652 Ll2LxWOagynlSgJ.exe Ll2LxWOagynlSgJ.exe PID 1652 wrote to memory of 1636 1652 Ll2LxWOagynlSgJ.exe Ll2LxWOagynlSgJ.exe PID 1652 wrote to memory of 1636 1652 Ll2LxWOagynlSgJ.exe Ll2LxWOagynlSgJ.exe PID 1652 wrote to memory of 1636 1652 Ll2LxWOagynlSgJ.exe Ll2LxWOagynlSgJ.exe PID 1652 wrote to memory of 1840 1652 Ll2LxWOagynlSgJ.exe Ll2LxWOagynlSgJ.exe PID 1652 wrote to memory of 1840 1652 Ll2LxWOagynlSgJ.exe Ll2LxWOagynlSgJ.exe PID 1652 wrote to memory of 1840 1652 Ll2LxWOagynlSgJ.exe Ll2LxWOagynlSgJ.exe PID 1652 wrote to memory of 1840 1652 Ll2LxWOagynlSgJ.exe Ll2LxWOagynlSgJ.exe PID 1652 wrote to memory of 1840 1652 Ll2LxWOagynlSgJ.exe Ll2LxWOagynlSgJ.exe PID 1652 wrote to memory of 1840 1652 Ll2LxWOagynlSgJ.exe Ll2LxWOagynlSgJ.exe PID 1652 wrote to memory of 1840 1652 Ll2LxWOagynlSgJ.exe Ll2LxWOagynlSgJ.exe PID 1652 wrote to memory of 1840 1652 Ll2LxWOagynlSgJ.exe Ll2LxWOagynlSgJ.exe PID 1652 wrote to memory of 1840 1652 Ll2LxWOagynlSgJ.exe Ll2LxWOagynlSgJ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ll2LxWOagynlSgJ.exe"C:\Users\Admin\AppData\Local\Temp\Ll2LxWOagynlSgJ.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AhuFCWIiU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2378.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Ll2LxWOagynlSgJ.exe"C:\Users\Admin\AppData\Local\Temp\Ll2LxWOagynlSgJ.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Ll2LxWOagynlSgJ.exe"C:\Users\Admin\AppData\Local\Temp\Ll2LxWOagynlSgJ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2378.tmpMD5
01dc1ed1183dc0aa981275637d3e81bf
SHA144b95374dd34571b7085e70c14fa4d04a4636942
SHA2569295bd678071e53a8e22896a37191e2f573f3a479e03f718f9b3878435be33a1
SHA512c92c63e99e3b6af93646976afce6776620effb64b35bbd5da77da6f1ae5aa2e3f1aed002fa81ef9cc06886d80cb620f639e64fe09ce2f529813fa6db67c5cec2
-
memory/564-68-0x0000000000000000-mapping.dmp
-
memory/1652-67-0x0000000004DA0000-0x0000000004DDE000-memory.dmpFilesize
248KB
-
memory/1652-64-0x0000000004CE2000-0x0000000004CE3000-memory.dmpFilesize
4KB
-
memory/1652-65-0x0000000000830000-0x000000000083E000-memory.dmpFilesize
56KB
-
memory/1652-66-0x0000000004F80000-0x0000000004FFB000-memory.dmpFilesize
492KB
-
memory/1652-60-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/1652-63-0x0000000004CE1000-0x0000000004CE2000-memory.dmpFilesize
4KB
-
memory/1652-62-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/1840-71-0x00000000004375FE-mapping.dmp
-
memory/1840-70-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1840-72-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1840-74-0x0000000004910000-0x0000000004911000-memory.dmpFilesize
4KB