Analysis
-
max time kernel
107s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-05-2021 12:48
Static task
static1
Behavioral task
behavioral1
Sample
Order 4503860408.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Order 4503860408.exe
Resource
win10v20210408
General
-
Target
Order 4503860408.exe
-
Size
31KB
-
MD5
0888f0a595168ba009400babfe2e7a2d
-
SHA1
f84aa6d3fe9dc66f27a49bd94b9057a19aa66e0a
-
SHA256
ce7554fa09d44e22a27ff09a105b6a50c26b1b7476b79a6c18941bb6b7d96b30
-
SHA512
0decd4df19a8dfdbbec21165881368c303d09d98bfc12447768f83d10fa649df5fb6166915b88fc18e55af6a515360f5f0c00aec492bcd851494a2106a80f8f0
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1703315481:AAF9ojcRH3Y4Iq9oLNsz7JFyV4u3ph8lCtU/sendDocument
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2952-121-0x000000000043777E-mapping.dmp family_agenttesla behavioral2/memory/2952-120-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order 4503860408.exedescription pid process target process PID 2840 set thread context of 2952 2840 Order 4503860408.exe Order 4503860408.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Order 4503860408.exepid process 2952 Order 4503860408.exe 2952 Order 4503860408.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order 4503860408.exeOrder 4503860408.exedescription pid process Token: SeDebugPrivilege 2840 Order 4503860408.exe Token: SeDebugPrivilege 2952 Order 4503860408.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Order 4503860408.exepid process 2952 Order 4503860408.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Order 4503860408.exedescription pid process target process PID 2840 wrote to memory of 2952 2840 Order 4503860408.exe Order 4503860408.exe PID 2840 wrote to memory of 2952 2840 Order 4503860408.exe Order 4503860408.exe PID 2840 wrote to memory of 2952 2840 Order 4503860408.exe Order 4503860408.exe PID 2840 wrote to memory of 2952 2840 Order 4503860408.exe Order 4503860408.exe PID 2840 wrote to memory of 2952 2840 Order 4503860408.exe Order 4503860408.exe PID 2840 wrote to memory of 2952 2840 Order 4503860408.exe Order 4503860408.exe PID 2840 wrote to memory of 2952 2840 Order 4503860408.exe Order 4503860408.exe PID 2840 wrote to memory of 2952 2840 Order 4503860408.exe Order 4503860408.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order 4503860408.exe"C:\Users\Admin\AppData\Local\Temp\Order 4503860408.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order 4503860408.exe"C:\Users\Admin\AppData\Local\Temp\Order 4503860408.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Order 4503860408.exe.logMD5
bca5d9d288a7809c63f2d594cb7c7b94
SHA111689c8a592cd8706f0155b4574488dd872cbd97
SHA256d7a3ed9b26c989e840532a7f0fa21bc508f8fbcb2d37116fade84280f2a865ed
SHA512db30f307e6818573f06f115818476104abfce94f15d9ad11e8163aa3cc19cee4cc3c87c98ef45d5c978b6f166089cc0283e3cc9a5db8359a425c8da7039dae0d
-
memory/2840-114-0x0000000000A30000-0x0000000000A31000-memory.dmpFilesize
4KB
-
memory/2840-116-0x0000000005A00000-0x0000000005A01000-memory.dmpFilesize
4KB
-
memory/2840-117-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/2840-118-0x0000000005900000-0x0000000005922000-memory.dmpFilesize
136KB
-
memory/2840-119-0x0000000006710000-0x0000000006711000-memory.dmpFilesize
4KB
-
memory/2952-120-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2952-121-0x000000000043777E-mapping.dmp
-
memory/2952-127-0x0000000005870000-0x0000000005871000-memory.dmpFilesize
4KB
-
memory/2952-128-0x0000000005910000-0x0000000005911000-memory.dmpFilesize
4KB
-
memory/2952-129-0x0000000006480000-0x0000000006481000-memory.dmpFilesize
4KB
-
memory/2952-130-0x0000000006B50000-0x0000000006B51000-memory.dmpFilesize
4KB
-
memory/2952-131-0x0000000001710000-0x0000000001711000-memory.dmpFilesize
4KB