Analysis
-
max time kernel
147s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
11-05-2021 10:36
Static task
static1
Behavioral task
behavioral1
Sample
Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe
Resource
win10v20210410
General
-
Target
Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe
-
Size
940KB
-
MD5
4239f6a01b20697056527dc5c5b33794
-
SHA1
8c535c57e02423dd83f38225f0a2fbf517c558ea
-
SHA256
d5c6e817e81a13cd55bf34551de9665821e3402bd4aa8c25ef302044502dc509
-
SHA512
2792430bf7160e0067861dfc0e246048e035113af39f426ef4dd59b825bc610fb1cdcd83e70ae9d466d0b4cf65eade4c5eccb8bc8f7cac5c67417f7417c64aca
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.corroshield.co.id - Port:
587 - Username:
procurement@corroshield.co.id - Password:
kramatjati1945
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/824-66-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/824-67-0x000000000043764E-mapping.dmp family_agenttesla behavioral1/memory/824-68-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exedescription pid process target process PID 484 set thread context of 824 484 Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exepowershell.exepid process 824 Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe 824 Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe 332 powershell.exe 332 powershell.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exepid process 824 Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exepowershell.exedescription pid process Token: SeDebugPrivilege 824 Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe Token: SeDebugPrivilege 332 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exedescription pid process target process PID 484 wrote to memory of 332 484 Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe powershell.exe PID 484 wrote to memory of 332 484 Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe powershell.exe PID 484 wrote to memory of 332 484 Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe powershell.exe PID 484 wrote to memory of 332 484 Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe powershell.exe PID 484 wrote to memory of 824 484 Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe PID 484 wrote to memory of 824 484 Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe PID 484 wrote to memory of 824 484 Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe PID 484 wrote to memory of 824 484 Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe PID 484 wrote to memory of 824 484 Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe PID 484 wrote to memory of 824 484 Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe PID 484 wrote to memory of 824 484 Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe PID 484 wrote to memory of 824 484 Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe PID 484 wrote to memory of 824 484 Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe"C:\Users\Admin\AppData\Local\Temp\Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe"C:\Users\Admin\AppData\Local\Temp\Frozen Seafood Specification BT vannamei shrimps mackerel supply data RFQ 3FCL 0086211052021.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/332-85-0x00000000060B0000-0x00000000060B1000-memory.dmpFilesize
4KB
-
memory/332-86-0x00000000060E0000-0x00000000060E1000-memory.dmpFilesize
4KB
-
memory/332-73-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB
-
memory/332-110-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/332-74-0x00000000024E0000-0x00000000024E1000-memory.dmpFilesize
4KB
-
memory/332-65-0x0000000000000000-mapping.dmp
-
memory/332-109-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/332-76-0x0000000004812000-0x0000000004813000-memory.dmpFilesize
4KB
-
memory/332-108-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/332-70-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/332-94-0x00000000055D0000-0x00000000055D1000-memory.dmpFilesize
4KB
-
memory/332-72-0x0000000001E90000-0x0000000001E91000-memory.dmpFilesize
4KB
-
memory/332-93-0x0000000006290000-0x0000000006291000-memory.dmpFilesize
4KB
-
memory/332-80-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/332-77-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/332-75-0x0000000004810000-0x0000000004811000-memory.dmpFilesize
4KB
-
memory/484-64-0x00000000048A0000-0x000000000493B000-memory.dmpFilesize
620KB
-
memory/484-59-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/484-61-0x0000000000590000-0x0000000000594000-memory.dmpFilesize
16KB
-
memory/484-62-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/484-63-0x0000000005360000-0x0000000005435000-memory.dmpFilesize
852KB
-
memory/824-67-0x000000000043764E-mapping.dmp
-
memory/824-71-0x0000000004B10000-0x0000000004B11000-memory.dmpFilesize
4KB
-
memory/824-68-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/824-66-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB