Analysis
-
max time kernel
112s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
11-05-2021 12:48
Static task
static1
Behavioral task
behavioral1
Sample
Order 4503860408.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Order 4503860408.exe
Resource
win10v20210408
General
-
Target
Order 4503860408.exe
-
Size
31KB
-
MD5
0888f0a595168ba009400babfe2e7a2d
-
SHA1
f84aa6d3fe9dc66f27a49bd94b9057a19aa66e0a
-
SHA256
ce7554fa09d44e22a27ff09a105b6a50c26b1b7476b79a6c18941bb6b7d96b30
-
SHA512
0decd4df19a8dfdbbec21165881368c303d09d98bfc12447768f83d10fa649df5fb6166915b88fc18e55af6a515360f5f0c00aec492bcd851494a2106a80f8f0
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1703315481:AAF9ojcRH3Y4Iq9oLNsz7JFyV4u3ph8lCtU/sendDocument
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1624-63-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1624-64-0x000000000043777E-mapping.dmp family_agenttesla behavioral1/memory/1624-65-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Downloads MZ/PE file
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order 4503860408.exedescription pid process target process PID 1768 set thread context of 1624 1768 Order 4503860408.exe Order 4503860408.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Order 4503860408.exepid process 1624 Order 4503860408.exe 1624 Order 4503860408.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order 4503860408.exeOrder 4503860408.exedescription pid process Token: SeDebugPrivilege 1768 Order 4503860408.exe Token: SeDebugPrivilege 1624 Order 4503860408.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Order 4503860408.exepid process 1624 Order 4503860408.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Order 4503860408.exedescription pid process target process PID 1768 wrote to memory of 1624 1768 Order 4503860408.exe Order 4503860408.exe PID 1768 wrote to memory of 1624 1768 Order 4503860408.exe Order 4503860408.exe PID 1768 wrote to memory of 1624 1768 Order 4503860408.exe Order 4503860408.exe PID 1768 wrote to memory of 1624 1768 Order 4503860408.exe Order 4503860408.exe PID 1768 wrote to memory of 1624 1768 Order 4503860408.exe Order 4503860408.exe PID 1768 wrote to memory of 1624 1768 Order 4503860408.exe Order 4503860408.exe PID 1768 wrote to memory of 1624 1768 Order 4503860408.exe Order 4503860408.exe PID 1768 wrote to memory of 1624 1768 Order 4503860408.exe Order 4503860408.exe PID 1768 wrote to memory of 1624 1768 Order 4503860408.exe Order 4503860408.exe PID 1768 wrote to memory of 1624 1768 Order 4503860408.exe Order 4503860408.exe PID 1768 wrote to memory of 1624 1768 Order 4503860408.exe Order 4503860408.exe PID 1768 wrote to memory of 1624 1768 Order 4503860408.exe Order 4503860408.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order 4503860408.exe"C:\Users\Admin\AppData\Local\Temp\Order 4503860408.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order 4503860408.exe"C:\Users\Admin\AppData\Local\Temp\Order 4503860408.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1624-63-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1624-64-0x000000000043777E-mapping.dmp
-
memory/1624-65-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1624-67-0x00000000006D0000-0x00000000006D1000-memory.dmpFilesize
4KB
-
memory/1624-68-0x00000000006D1000-0x00000000006D2000-memory.dmpFilesize
4KB
-
memory/1768-59-0x0000000000820000-0x0000000000821000-memory.dmpFilesize
4KB
-
memory/1768-61-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/1768-62-0x0000000000830000-0x0000000000852000-memory.dmpFilesize
136KB