Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
04-05-2021 14:03
Static task
static1
Behavioral task
behavioral1
Sample
EXW QUOTATION.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
EXW QUOTATION.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
EXW QUOTATION.exe
-
Size
651KB
-
MD5
b6e6ec67a638e2ee7344d847a749ded0
-
SHA1
9da346f12d9bd00d454a219f73fe628dbf408817
-
SHA256
226055fd9a87d3bb38acb21c4d3dd7222d600003c72fab036286b9b15b233518
-
SHA512
227f0ced3757b765e8f7e474dd7bcbf8bebd185172e0601649df422dce5e454d0abc4ef0a30c5aa23941d926176fe0c85b186bc4c956acc820f8e29fc95ccbe2
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
server126.web-hosting.com - Port:
587 - Username:
jokelogs@omnlltd.com - Password:
E#@Dfb$LbM)M
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4192-127-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/4192-128-0x00000000004374AE-mapping.dmp family_agenttesla behavioral2/memory/4192-133-0x0000000004E10000-0x000000000530E000-memory.dmp family_agenttesla -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
EXW QUOTATION.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\EupFNx = "C:\\Users\\Admin\\AppData\\Roaming\\EupFNx\\EupFNx.exe" EXW QUOTATION.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
EXW QUOTATION.exedescription pid process target process PID 4660 set thread context of 4192 4660 EXW QUOTATION.exe EXW QUOTATION.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
EXW QUOTATION.exepid process 4192 EXW QUOTATION.exe 4192 EXW QUOTATION.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
EXW QUOTATION.exedescription pid process Token: SeDebugPrivilege 4192 EXW QUOTATION.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
EXW QUOTATION.exepid process 4660 EXW QUOTATION.exe 4660 EXW QUOTATION.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXW QUOTATION.exedescription pid process target process PID 4660 wrote to memory of 4192 4660 EXW QUOTATION.exe EXW QUOTATION.exe PID 4660 wrote to memory of 4192 4660 EXW QUOTATION.exe EXW QUOTATION.exe PID 4660 wrote to memory of 4192 4660 EXW QUOTATION.exe EXW QUOTATION.exe PID 4660 wrote to memory of 4192 4660 EXW QUOTATION.exe EXW QUOTATION.exe PID 4660 wrote to memory of 4192 4660 EXW QUOTATION.exe EXW QUOTATION.exe PID 4660 wrote to memory of 4192 4660 EXW QUOTATION.exe EXW QUOTATION.exe PID 4660 wrote to memory of 4192 4660 EXW QUOTATION.exe EXW QUOTATION.exe PID 4660 wrote to memory of 4192 4660 EXW QUOTATION.exe EXW QUOTATION.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\EXW QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\EXW QUOTATION.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EXW QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\EXW QUOTATION.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4192-127-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/4192-135-0x0000000005B70000-0x0000000005B71000-memory.dmpFilesize
4KB
-
memory/4192-134-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/4192-133-0x0000000004E10000-0x000000000530E000-memory.dmpFilesize
5.0MB
-
memory/4192-128-0x00000000004374AE-mapping.dmp
-
memory/4660-119-0x0000000005850000-0x0000000005851000-memory.dmpFilesize
4KB
-
memory/4660-121-0x00000000059A0000-0x0000000005E9E000-memory.dmpFilesize
5.0MB
-
memory/4660-123-0x00000000059A0000-0x0000000005E9E000-memory.dmpFilesize
5.0MB
-
memory/4660-122-0x00000000059A0000-0x0000000005E9E000-memory.dmpFilesize
5.0MB
-
memory/4660-124-0x0000000009740000-0x000000000974E000-memory.dmpFilesize
56KB
-
memory/4660-125-0x0000000001580000-0x00000000015F8000-memory.dmpFilesize
480KB
-
memory/4660-126-0x00000000078B0000-0x00000000078EE000-memory.dmpFilesize
248KB
-
memory/4660-120-0x0000000005B70000-0x0000000005B71000-memory.dmpFilesize
4KB
-
memory/4660-114-0x0000000000FA0000-0x0000000000FA1000-memory.dmpFilesize
4KB
-
memory/4660-118-0x00000000059A0000-0x00000000059A1000-memory.dmpFilesize
4KB
-
memory/4660-117-0x0000000005EA0000-0x0000000005EA1000-memory.dmpFilesize
4KB
-
memory/4660-116-0x00000000058B0000-0x00000000058B1000-memory.dmpFilesize
4KB