Analysis
-
max time kernel
134s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
11-05-2021 12:52
Static task
static1
Behavioral task
behavioral1
Sample
cargo details.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
cargo details.exe
Resource
win10v20210410
General
-
Target
cargo details.exe
-
Size
852KB
-
MD5
667dc2043a6a1ccb0f70810e7d566b58
-
SHA1
6d749c15e64e961690e6614761ff9b8370d3bf43
-
SHA256
01ca714d163a5a4498d1174c893b519dce2f0cc968bf7aac2474694b1109f6d9
-
SHA512
ca335532db0832b26ae5ef0bbb7f5ec0aa971ea54be139a367d93313f38108b36c03dbd1cf571e769f55d6c6daab87aec7bef75c102a7f3c21d262604da6248f
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
server126.web-hosting.com - Port:
587 - Username:
jokelogs@omnlltd.com - Password:
E#@Dfb$LbM)M
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/752-125-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/752-126-0x00000000004374AE-mapping.dmp family_agenttesla behavioral2/memory/752-132-0x0000000004F80000-0x000000000547E000-memory.dmp family_agenttesla -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
cargo details.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\EupFNx = "C:\\Users\\Admin\\AppData\\Roaming\\EupFNx\\EupFNx.exe" cargo details.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cargo details.exedescription pid process target process PID 2228 set thread context of 752 2228 cargo details.exe cargo details.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
cargo details.exepid process 752 cargo details.exe 752 cargo details.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cargo details.exedescription pid process Token: SeDebugPrivilege 752 cargo details.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cargo details.exedescription pid process target process PID 2228 wrote to memory of 752 2228 cargo details.exe cargo details.exe PID 2228 wrote to memory of 752 2228 cargo details.exe cargo details.exe PID 2228 wrote to memory of 752 2228 cargo details.exe cargo details.exe PID 2228 wrote to memory of 752 2228 cargo details.exe cargo details.exe PID 2228 wrote to memory of 752 2228 cargo details.exe cargo details.exe PID 2228 wrote to memory of 752 2228 cargo details.exe cargo details.exe PID 2228 wrote to memory of 752 2228 cargo details.exe cargo details.exe PID 2228 wrote to memory of 752 2228 cargo details.exe cargo details.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cargo details.exe"C:\Users\Admin\AppData\Local\Temp\cargo details.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cargo details.exe"C:\Users\Admin\AppData\Local\Temp\cargo details.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cargo details.exe.logMD5
90acfd72f14a512712b1a7380c0faf60
SHA140ba4accb8faa75887e84fb8e38d598dc8cf0f12
SHA25620806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86
SHA51229dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9
-
memory/752-125-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/752-134-0x0000000005C70000-0x0000000005C71000-memory.dmpFilesize
4KB
-
memory/752-133-0x00000000053E0000-0x00000000053E1000-memory.dmpFilesize
4KB
-
memory/752-132-0x0000000004F80000-0x000000000547E000-memory.dmpFilesize
5.0MB
-
memory/752-126-0x00000000004374AE-mapping.dmp
-
memory/2228-119-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/2228-122-0x00000000056F0000-0x00000000056F4000-memory.dmpFilesize
16KB
-
memory/2228-123-0x0000000006AF0000-0x0000000006BBB000-memory.dmpFilesize
812KB
-
memory/2228-124-0x00000000090D0000-0x0000000009164000-memory.dmpFilesize
592KB
-
memory/2228-121-0x0000000005660000-0x0000000005B5E000-memory.dmpFilesize
5.0MB
-
memory/2228-120-0x0000000005910000-0x0000000005911000-memory.dmpFilesize
4KB
-
memory/2228-114-0x0000000000D10000-0x0000000000D11000-memory.dmpFilesize
4KB
-
memory/2228-118-0x0000000005700000-0x0000000005701000-memory.dmpFilesize
4KB
-
memory/2228-117-0x0000000005B60000-0x0000000005B61000-memory.dmpFilesize
4KB
-
memory/2228-116-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB