Analysis
-
max time kernel
143s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
06-05-2021 22:02
General
-
Target
SWIFT-MT103_10262020.pdf.exe
-
Size
962KB
-
MD5
d45ea472e02716273a88ec6093443db5
-
SHA1
bfccdf852c01557bf54eb5dd018c34f28f4c9df4
-
SHA256
02eca93ecccb20370063ee84fc8b50f70bdc84ced1c5e09016ea7c06e7946a51
-
SHA512
bcee0231d25468be11ebf6ad07f62c1e147e5a0a5c009f4d931b878ea6d494b39700bf0bc0b3a566ae8a556ef9b234cdbc7f2285182515fe533c2fdadd05a161
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.abr.rs - Port:
587 - Username:
finansije@abr.rs - Password:
Royal-1111
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SWIFT-MT103_10262020.pdf.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT-MT103_10262020.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SWIFT-MT103_10262020.pdf.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT-MT103_10262020.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\SWIFT-MT103_10262020.pdf.exe.logMD5
d339c10085614c3291fd833fffbd7529
SHA1f94f4028ad3340e9be0359fe8b500d128e7fd1bd
SHA256781f22b76348ca470263f04aa91eb3424d700a6b19812803317bd70f261d1f17
SHA512b661d6b6642841f9050e9694e236db6c291c746f08a5d8a0f75ae3ef6ba7a2f62c32ea9b55685e55eb957c3436c4f30e02c679f366f09b9acc51b9247033a433
-
memory/188-116-0x000000000043752E-mapping.dmp
-
memory/188-115-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/188-118-0x0000000002AD0000-0x0000000002AD1000-memory.dmpFilesize
4KB
-
memory/188-119-0x0000000002AD1000-0x0000000002AD2000-memory.dmpFilesize
4KB
-
memory/188-120-0x0000000002AD2000-0x0000000002AD3000-memory.dmpFilesize
4KB
-
memory/3952-114-0x0000000002450000-0x0000000002451000-memory.dmpFilesize
4KB