Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
11-05-2021 10:30
Static task
static1
Behavioral task
behavioral1
Sample
PO.#4500499953.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO.#4500499953.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
PO.#4500499953.exe
-
Size
883KB
-
MD5
0c3098e9105cbea5e2d6ab99849afaeb
-
SHA1
35286653ce0368bef6a4344c4275279c60d2471e
-
SHA256
091941767ac84ff519693960cd6cb15e799da88cd08477977ec10fad6fe00b4d
-
SHA512
6b4221f84a1f9731c6cfbecc7c06c340d39d60cdafbcf44220a8eed5009627d03bc01e52b41997f72d10b323d4b6ab2786c99a0ad6334962a05f1ee4a7e6e382
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
wasstech.com - Port:
587 - Username:
rasha.adel@wasstech.com - Password:
Sunray2700@@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1156-66-0x000000000043760E-mapping.dmp family_agenttesla behavioral1/memory/1156-65-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1156-67-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\NXLun = "C:\\Users\\Admin\\AppData\\Roaming\\NXLun\\NXLun.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO.#4500499953.exedescription pid process target process PID 1820 set thread context of 1156 1820 PO.#4500499953.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
PO.#4500499953.exeRegSvcs.exepid process 1820 PO.#4500499953.exe 1820 PO.#4500499953.exe 1156 RegSvcs.exe 1156 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO.#4500499953.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1820 PO.#4500499953.exe Token: SeDebugPrivilege 1156 RegSvcs.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
PO.#4500499953.exedescription pid process target process PID 1820 wrote to memory of 1028 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 1028 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 1028 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 1028 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 1028 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 1028 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 1028 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 584 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 584 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 584 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 584 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 584 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 584 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 584 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 1156 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 1156 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 1156 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 1156 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 1156 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 1156 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 1156 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 1156 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 1156 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 1156 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 1156 1820 PO.#4500499953.exe RegSvcs.exe PID 1820 wrote to memory of 1156 1820 PO.#4500499953.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO.#4500499953.exe"C:\Users\Admin\AppData\Local\Temp\PO.#4500499953.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1156-66-0x000000000043760E-mapping.dmp
-
memory/1156-65-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1156-67-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1156-69-0x0000000001200000-0x0000000001201000-memory.dmpFilesize
4KB
-
memory/1820-59-0x0000000000F90000-0x0000000000F91000-memory.dmpFilesize
4KB
-
memory/1820-61-0x0000000000550000-0x0000000000551000-memory.dmpFilesize
4KB
-
memory/1820-62-0x00000000004F0000-0x00000000004F4000-memory.dmpFilesize
16KB
-
memory/1820-63-0x00000000051E0000-0x00000000052A9000-memory.dmpFilesize
804KB
-
memory/1820-64-0x0000000007790000-0x0000000007824000-memory.dmpFilesize
592KB