Analysis
- max time kernel
124s - max time network
123s - platform
windows10_x64 - resource
win10v20210410 - submitted
07/06/2021, 09:56
General
- Target P0A2249.exe
- Size 1.8MB
- Sample210607-32142phzes
- SHA256 ad85d8f9cafa414d61158057243958855cd0c2cc4ee3dc2911f3e9e958d8edd7
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.hassani777.xyz
-
Port
587
-
Username
-
Password
W@yKjYm0
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\P0A2249.exe"C:\Users\Admin\AppData\Local\Temp\P0A2249.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\P0A2249.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LRZOYBXJdSboD.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LRZOYBXJdSboD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB5B4.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LRZOYBXJdSboD.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\P0A2249.exe"C:\Users\Admin\AppData\Local\Temp\P0A2249.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/512-122-0x0000000005000000-0x000000000509C000-memory.dmp
memory/512-120-0x0000000005360000-0x0000000005361000-memory.dmp
memory/512-121-0x00000000053C0000-0x00000000053DE000-memory.dmp
memory/512-116-0x00000000050A0000-0x00000000050A1000-memory.dmp
memory/512-123-0x0000000005E60000-0x0000000005ED5000-memory.dmp
memory/512-124-0x0000000008390000-0x00000000083CE000-memory.dmp
memory/512-114-0x00000000006A0000-0x00000000006A1000-memory.dmp
memory/512-117-0x0000000005660000-0x0000000005661000-memory.dmp
memory/512-118-0x0000000005200000-0x0000000005201000-memory.dmp
memory/512-119-0x0000000005090000-0x0000000005091000-memory.dmp
memory/1248-160-0x0000000005410000-0x000000000590E000-memory.dmp
memory/1248-138-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2276-193-0x000000007EDC0000-0x000000007EDC1000-memory.dmp
memory/2276-196-0x0000000006BE3000-0x0000000006BE4000-memory.dmp
memory/2276-159-0x0000000006BE0000-0x0000000006BE1000-memory.dmp
memory/2276-162-0x0000000006BE2000-0x0000000006BE3000-memory.dmp
memory/2276-167-0x00000000071B0000-0x00000000071B1000-memory.dmp
memory/2276-170-0x00000000081B0000-0x00000000081B1000-memory.dmp
memory/3140-195-0x0000000005153000-0x0000000005154000-memory.dmp
memory/3140-153-0x0000000005150000-0x0000000005151000-memory.dmp
memory/3140-192-0x000000007E480000-0x000000007E481000-memory.dmp
memory/3140-157-0x0000000005152000-0x0000000005153000-memory.dmp
memory/3140-173-0x0000000008AA0000-0x0000000008AA1000-memory.dmp
memory/3832-155-0x00000000073B0000-0x00000000073B1000-memory.dmp
memory/3832-149-0x0000000000CE2000-0x0000000000CE3000-memory.dmp
memory/3832-150-0x0000000006C70000-0x0000000006C71000-memory.dmp
memory/3832-194-0x000000007E0D0000-0x000000007E0D1000-memory.dmp
memory/3832-148-0x0000000000CE0000-0x0000000000CE1000-memory.dmp
memory/3832-145-0x0000000006C00000-0x0000000006C01000-memory.dmp
memory/3832-197-0x0000000000CE3000-0x0000000000CE4000-memory.dmp
memory/3832-142-0x0000000006A60000-0x0000000006A61000-memory.dmp
memory/3832-133-0x0000000006D60000-0x0000000006D61000-memory.dmp
memory/3832-130-0x00000000066F0000-0x00000000066F1000-memory.dmp