Analysis
-
max time kernel
135s -
max time network
119s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-05-2021 10:30
Static task
static1
Behavioral task
behavioral1
Sample
vkFhiUvXw8joCXn.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
vkFhiUvXw8joCXn.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
vkFhiUvXw8joCXn.exe
-
Size
851KB
-
MD5
7e6a19d305a690e887020b9fe1b57488
-
SHA1
a283a4245b4b0b979ec7e63bda0fa41725b7adec
-
SHA256
ef493fe2688db7c97fd7e0af12bae0b42aeee9c1c7ccf241865e1cfa5cb50cac
-
SHA512
d1e3b9608ef58e25992ffa11f2d6550e633c48cd1888edc7c82530b31fff3edb922dd1a0f22384623bc6371409f8daa6936d968fcb7ceb35e96ce76a4894f585
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
wasstech.com - Port:
587 - Username:
psme@wasstech.com - Password:
Sunray2700@@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1352-125-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/1352-126-0x000000000043762E-mapping.dmp family_agenttesla behavioral2/memory/1352-131-0x0000000005530000-0x0000000005A2E000-memory.dmp family_agenttesla -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\NXLun = "C:\\Users\\Admin\\AppData\\Roaming\\NXLun\\NXLun.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
vkFhiUvXw8joCXn.exedescription pid process target process PID 800 set thread context of 1352 800 vkFhiUvXw8joCXn.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
vkFhiUvXw8joCXn.exeRegSvcs.exepid process 800 vkFhiUvXw8joCXn.exe 1352 RegSvcs.exe 1352 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vkFhiUvXw8joCXn.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 800 vkFhiUvXw8joCXn.exe Token: SeDebugPrivilege 1352 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
vkFhiUvXw8joCXn.exedescription pid process target process PID 800 wrote to memory of 1352 800 vkFhiUvXw8joCXn.exe RegSvcs.exe PID 800 wrote to memory of 1352 800 vkFhiUvXw8joCXn.exe RegSvcs.exe PID 800 wrote to memory of 1352 800 vkFhiUvXw8joCXn.exe RegSvcs.exe PID 800 wrote to memory of 1352 800 vkFhiUvXw8joCXn.exe RegSvcs.exe PID 800 wrote to memory of 1352 800 vkFhiUvXw8joCXn.exe RegSvcs.exe PID 800 wrote to memory of 1352 800 vkFhiUvXw8joCXn.exe RegSvcs.exe PID 800 wrote to memory of 1352 800 vkFhiUvXw8joCXn.exe RegSvcs.exe PID 800 wrote to memory of 1352 800 vkFhiUvXw8joCXn.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vkFhiUvXw8joCXn.exe"C:\Users\Admin\AppData\Local\Temp\vkFhiUvXw8joCXn.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/800-114-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB
-
memory/800-116-0x0000000004D50000-0x0000000004D51000-memory.dmpFilesize
4KB
-
memory/800-117-0x0000000005320000-0x0000000005321000-memory.dmpFilesize
4KB
-
memory/800-118-0x0000000004EC0000-0x0000000004EC1000-memory.dmpFilesize
4KB
-
memory/800-119-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB
-
memory/800-120-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/800-121-0x0000000004E20000-0x000000000531E000-memory.dmpFilesize
5.0MB
-
memory/800-122-0x0000000004EB0000-0x0000000004EB4000-memory.dmpFilesize
16KB
-
memory/800-123-0x0000000000BD0000-0x0000000000C91000-memory.dmpFilesize
772KB
-
memory/800-124-0x0000000000DE0000-0x0000000000E6C000-memory.dmpFilesize
560KB
-
memory/1352-125-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1352-126-0x000000000043762E-mapping.dmp
-
memory/1352-131-0x0000000005530000-0x0000000005A2E000-memory.dmpFilesize
5.0MB
-
memory/1352-132-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/1352-133-0x0000000006220000-0x0000000006221000-memory.dmpFilesize
4KB