Analysis
-
max time kernel
143s -
max time network
122s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
20-06-2021 21:04
Static task
static1
Behavioral task
behavioral1
Sample
AWB & Shipping Documents.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
AWB & Shipping Documents.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
AWB & Shipping Documents.exe
-
Size
880KB
-
MD5
7c4194af8b96aba768004cf02dc66ff2
-
SHA1
0316176e546e300c41ab967ed0b671aa843e5298
-
SHA256
33a82cfa5ef0f113bfa98be28c2a3d8637423f8e22be91179ee36a907ef808ca
-
SHA512
e2fd5179e9a86cf428ac2c1b2e02479be736e905c9a280c50989b0f7d76dd9966ec9a0284ac07cc5074d01dd9a455e6a5fff396123369b2f027c229cfc6f2c4f
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
smtp.excetek-tw.com - Port:
587 - Username:
bangerlee@excetek-tw.com - Password:
^zC)hee7
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/456-67-0x000000000043761E-mapping.dmp family_agenttesla behavioral1/memory/456-66-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/456-68-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
Processes:
AWB & Shipping Documents.exedescription pid process target process PID 1056 set thread context of 456 1056 AWB & Shipping Documents.exe AWB & Shipping Documents.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
AWB & Shipping Documents.exeAWB & Shipping Documents.exepid process 1056 AWB & Shipping Documents.exe 456 AWB & Shipping Documents.exe 456 AWB & Shipping Documents.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AWB & Shipping Documents.exeAWB & Shipping Documents.exedescription pid process Token: SeDebugPrivilege 1056 AWB & Shipping Documents.exe Token: SeDebugPrivilege 456 AWB & Shipping Documents.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
AWB & Shipping Documents.exedescription pid process target process PID 1056 wrote to memory of 456 1056 AWB & Shipping Documents.exe AWB & Shipping Documents.exe PID 1056 wrote to memory of 456 1056 AWB & Shipping Documents.exe AWB & Shipping Documents.exe PID 1056 wrote to memory of 456 1056 AWB & Shipping Documents.exe AWB & Shipping Documents.exe PID 1056 wrote to memory of 456 1056 AWB & Shipping Documents.exe AWB & Shipping Documents.exe PID 1056 wrote to memory of 456 1056 AWB & Shipping Documents.exe AWB & Shipping Documents.exe PID 1056 wrote to memory of 456 1056 AWB & Shipping Documents.exe AWB & Shipping Documents.exe PID 1056 wrote to memory of 456 1056 AWB & Shipping Documents.exe AWB & Shipping Documents.exe PID 1056 wrote to memory of 456 1056 AWB & Shipping Documents.exe AWB & Shipping Documents.exe PID 1056 wrote to memory of 456 1056 AWB & Shipping Documents.exe AWB & Shipping Documents.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AWB & Shipping Documents.exe"C:\Users\Admin\AppData\Local\Temp\AWB & Shipping Documents.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AWB & Shipping Documents.exe"C:\Users\Admin\AppData\Local\Temp\AWB & Shipping Documents.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/456-67-0x000000000043761E-mapping.dmp
-
memory/456-66-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/456-68-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/456-70-0x0000000004D20000-0x0000000004D21000-memory.dmpFilesize
4KB
-
memory/1056-60-0x0000000001220000-0x0000000001221000-memory.dmpFilesize
4KB
-
memory/1056-62-0x0000000000210000-0x0000000000226000-memory.dmpFilesize
88KB
-
memory/1056-63-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/1056-64-0x0000000004F90000-0x0000000005005000-memory.dmpFilesize
468KB
-
memory/1056-65-0x00000000008F0000-0x0000000000940000-memory.dmpFilesize
320KB