Analysis
-
max time kernel
133s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-05-2021 11:08
Static task
static1
Behavioral task
behavioral1
Sample
BL COPY.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
BL COPY.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
BL COPY.exe
-
Size
885KB
-
MD5
d3a2edaff3070fd462a89b3c5d75391c
-
SHA1
63fe1e5b263c0cfc796010f7ff5e39ad631a39c5
-
SHA256
71276409f3ed154c5b43a4357d4644350d89c064e0db3ad4cca5570dbeaaa3a0
-
SHA512
7655eb938f69c33cf8e06b8ab6a7c9ad89cfaa3686af651a87f7c42ac7567c0e9db8cebc91775fd6ea76750e719bddc32632d0d4f870afecb5997975eda0b605
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.citechco.net - Port:
587 - Username:
anando@citechco.net - Password:
Webana@321#
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2648-125-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/2648-126-0x000000000043760E-mapping.dmp family_agenttesla -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\NXLun = "C:\\Users\\Admin\\AppData\\Roaming\\NXLun\\NXLun.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BL COPY.exedescription pid process target process PID 3920 set thread context of 2648 3920 BL COPY.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
BL COPY.exeRegSvcs.exepid process 3920 BL COPY.exe 2648 RegSvcs.exe 2648 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
BL COPY.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 3920 BL COPY.exe Token: SeDebugPrivilege 2648 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
BL COPY.exedescription pid process target process PID 3920 wrote to memory of 2648 3920 BL COPY.exe RegSvcs.exe PID 3920 wrote to memory of 2648 3920 BL COPY.exe RegSvcs.exe PID 3920 wrote to memory of 2648 3920 BL COPY.exe RegSvcs.exe PID 3920 wrote to memory of 2648 3920 BL COPY.exe RegSvcs.exe PID 3920 wrote to memory of 2648 3920 BL COPY.exe RegSvcs.exe PID 3920 wrote to memory of 2648 3920 BL COPY.exe RegSvcs.exe PID 3920 wrote to memory of 2648 3920 BL COPY.exe RegSvcs.exe PID 3920 wrote to memory of 2648 3920 BL COPY.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BL COPY.exe"C:\Users\Admin\AppData\Local\Temp\BL COPY.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2648-125-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2648-133-0x00000000061E0000-0x00000000061E1000-memory.dmpFilesize
4KB
-
memory/2648-132-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB
-
memory/2648-131-0x0000000005430000-0x0000000005431000-memory.dmpFilesize
4KB
-
memory/2648-126-0x000000000043760E-mapping.dmp
-
memory/3920-121-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/3920-114-0x0000000000850000-0x0000000000851000-memory.dmpFilesize
4KB
-
memory/3920-122-0x0000000005510000-0x0000000005514000-memory.dmpFilesize
16KB
-
memory/3920-123-0x0000000006050000-0x0000000006117000-memory.dmpFilesize
796KB
-
memory/3920-124-0x00000000085E0000-0x000000000866D000-memory.dmpFilesize
564KB
-
memory/3920-120-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/3920-119-0x0000000005210000-0x000000000570E000-memory.dmpFilesize
5.0MB
-
memory/3920-118-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/3920-117-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/3920-116-0x0000000005160000-0x0000000005161000-memory.dmpFilesize
4KB