Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
11-05-2021 12:53
Static task
static1
Behavioral task
behavioral1
Sample
cargo details.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cargo details.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
cargo details.exe
-
Size
852KB
-
MD5
667dc2043a6a1ccb0f70810e7d566b58
-
SHA1
6d749c15e64e961690e6614761ff9b8370d3bf43
-
SHA256
01ca714d163a5a4498d1174c893b519dce2f0cc968bf7aac2474694b1109f6d9
-
SHA512
ca335532db0832b26ae5ef0bbb7f5ec0aa971ea54be139a367d93313f38108b36c03dbd1cf571e769f55d6c6daab87aec7bef75c102a7f3c21d262604da6248f
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
server126.web-hosting.com - Port:
587 - Username:
jokelogs@omnlltd.com - Password:
E#@Dfb$LbM)M
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/396-66-0x00000000004374AE-mapping.dmp family_agenttesla behavioral1/memory/396-65-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/396-67-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
cargo details.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\EupFNx = "C:\\Users\\Admin\\AppData\\Roaming\\EupFNx\\EupFNx.exe" cargo details.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cargo details.exedescription pid process target process PID 1084 set thread context of 396 1084 cargo details.exe cargo details.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
cargo details.execargo details.exepid process 1084 cargo details.exe 396 cargo details.exe 396 cargo details.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
cargo details.execargo details.exedescription pid process Token: SeDebugPrivilege 1084 cargo details.exe Token: SeDebugPrivilege 396 cargo details.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
cargo details.exedescription pid process target process PID 1084 wrote to memory of 992 1084 cargo details.exe cargo details.exe PID 1084 wrote to memory of 992 1084 cargo details.exe cargo details.exe PID 1084 wrote to memory of 992 1084 cargo details.exe cargo details.exe PID 1084 wrote to memory of 992 1084 cargo details.exe cargo details.exe PID 1084 wrote to memory of 396 1084 cargo details.exe cargo details.exe PID 1084 wrote to memory of 396 1084 cargo details.exe cargo details.exe PID 1084 wrote to memory of 396 1084 cargo details.exe cargo details.exe PID 1084 wrote to memory of 396 1084 cargo details.exe cargo details.exe PID 1084 wrote to memory of 396 1084 cargo details.exe cargo details.exe PID 1084 wrote to memory of 396 1084 cargo details.exe cargo details.exe PID 1084 wrote to memory of 396 1084 cargo details.exe cargo details.exe PID 1084 wrote to memory of 396 1084 cargo details.exe cargo details.exe PID 1084 wrote to memory of 396 1084 cargo details.exe cargo details.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cargo details.exe"C:\Users\Admin\AppData\Local\Temp\cargo details.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cargo details.exe"C:\Users\Admin\AppData\Local\Temp\cargo details.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\cargo details.exe"C:\Users\Admin\AppData\Local\Temp\cargo details.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/396-66-0x00000000004374AE-mapping.dmp
-
memory/396-65-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/396-67-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/396-69-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/1084-59-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/1084-61-0x0000000000470000-0x0000000000471000-memory.dmpFilesize
4KB
-
memory/1084-62-0x00000000006E0000-0x00000000006E4000-memory.dmpFilesize
16KB
-
memory/1084-63-0x00000000057A0000-0x000000000586B000-memory.dmpFilesize
812KB
-
memory/1084-64-0x0000000005200000-0x0000000005294000-memory.dmpFilesize
592KB